The delivery-ci-notify npm package (version 35.2.5) includes a malicious component in its index.js that loads a shim script to select a platform-specific native binary payload. This payload is fetched from one of three hardcoded Cloudflare workers.dev domains, with hostnames dynamically assembled at runtime to evade static analysis. If the HTTPS fetch fails, the shim falls back to retrieving the payload via a DNS TXT record covert channel under *.dl.wel1.ru domains, reassembling base64-encoded chunks into an executable. The payload is written to temporary directories with disguised filenames ('.cache_<hex>' on Unix, 'dotnet_diag_<hex>.exe' on Windows), permissions set to executable, and then spawned detached via shell commands. Execution is controlled by a TTL state file and environment variable checks, with a no-op logger present to obfuscate activity. These behaviors indicate deliberate evasion and malicious intent rather than legitimate telemetry or build features.

This malicious package can execute arbitrary native code on the host system by downloading and running a concealed binary payload. This could lead to unauthorized code execution, persistence, and potentially further compromise of the affected environment. The use of evasion techniques and covert channels complicates detection and response.

No official patch or remediation guidance is provided in the available data. Users should avoid using delivery-ci-notify version 35.2.5 and remove it from their environments. Monitor for the presence of the package and associated suspicious files in temporary directories. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates or official fixes.