The delivery-ci-quality npm package (version 35.6.2) includes code in index.js that unconditionally loads a compatibility script (_compat.js) which downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains. The download uses a DNS-TXT base64 fallback channel over *.dl.wel1.ru. The binary is saved to a temporary path with disguised names, given executable permissions, and launched via shell commands as a detached background process with no standard input/output. The command and control hostnames are dynamically reconstructed at runtime to evade static analysis. No integrity checks (hash or signature verification) are performed on the downloaded binary. The malicious behavior is unrelated to the package's declared function as a pluggable delivery CI quality interface.

The malicious package can download and execute arbitrary binaries on the host system without user consent or verification, potentially leading to unauthorized code execution and system compromise. The use of anonymous Cloudflare Workers endpoints and obfuscated command and control mechanisms complicates detection and mitigation.

No official patch or remediation is currently documented. Users should avoid using delivery-ci-quality version 35.6.2 and remove it from their environments. Since no fix is confirmed, check vendor advisories or trusted security sources for updates. Consider scanning for and removing this package if present.