The delivery-ci-tech-holder npm package (version 35.3.4) includes malicious functionality triggered on require(). It loads a support script that reconstructs hardcoded destination URLs from split string arrays, contacting multiple suspicious domains (e.g., oob-worker.cf100-416.workers.dev) and a DNS-TXT fallback domain (sdk.dl.wel1.ru). It downloads a platform-specific binary, writes it to temporary directories (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), sets executable permissions, and spawns the binary detached from the parent process. The binary is executed without any hash or signature verification, and the filenames impersonate legitimate system components to avoid detection. This behavior enables arbitrary code execution with the privileges of the user installing the package. The obfuscation techniques are designed to evade static analysis.

An attacker controlling the external hosts can deliver arbitrary binaries that execute with the installer's privileges, potentially leading to full system compromise, data theft, or persistence. The lack of verification and use of obfuscation increases the risk of undetected malicious activity during package installation.

No official patch or remediation is currently available. Users should avoid using delivery-ci-tech-holder version 35.3.4. Verify package integrity before installation and consider using trusted package sources or scanning tools to detect malicious packages. Monitor for updates from the package publisher or security advisories for remediation guidance.