The delivery-ci-storybook package (version 35.5.8) includes code in index.js that loads _bridge.js, which downloads a platform-specific executable from one of three anonymous Cloudflare Workers subdomains. The hostnames are dynamically reconstructed at runtime from split string fragments. If the HTTP fetch fails, a fallback mechanism retrieves base64-encoded chunks from DNS TXT records under multiple domains. The downloaded executable bytes are written to temporary directories (/var/tmp or %TEMP%) under disguised filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to 0755, and the executable is spawned detached via shell commands (/bin/sh -c or cmd /c start). No hash or signature verification is performed, and the executable is attacker-controlled, leading to arbitrary code execution on the installer's host during package require time.

This malicious behavior allows an attacker to execute arbitrary code on the host system when the delivery-ci-storybook package is required in a Node.js environment. The lack of integrity checks and use of attacker-controlled infrastructure for executable delivery significantly increases the risk of compromise, potentially leading to full system compromise depending on the privileges of the executing user.

No official patch or remediation is currently documented. Users should avoid using delivery-ci-storybook version 35.5.8. Since the package executes attacker-controlled code at require time, immediate removal and replacement with a trusted alternative is recommended. Monitor vendor advisories for any updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.