The delivery-ci-pipeline-rules npm package at version 35.9.3 includes a malicious _init.js script that is loaded unconditionally by index.js. This script constructs attacker-controlled hostnames from fragmented strings and downloads platform-specific executables via HTTPS. The executables are saved to temporary directories under disguised filenames, permissioned for execution, and then launched detached using system shell commands. If HTTPS retrieval fails, the script falls back to a DNS-TXT covert channel to reconstruct the payload from base64-encoded TXT records across multiple DNS queries. The execution is gated by a long cache TTL (~22000 seconds). Installing or importing this package leads to execution of attacker-controlled binaries from non-publisher infrastructure, enabling remote code execution on the host.

Successful installation or import of this package results in arbitrary code execution on the host system, as attacker-controlled binaries are fetched and executed without user consent. This can lead to full system compromise, data theft, or further malicious activity. The malicious payload is delivered from infrastructure not controlled by the legitimate package publisher, increasing risk of undetected compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is confirmed, users should avoid installing or importing delivery-ci-pipeline-rules version 35.9.3. Verify package integrity and source before use. Consider removing the package if already installed and monitor for suspicious activity related to this package.