The delivery-ci-unit npm package version 35.9.3 includes malicious functionality where its index.js loads a loader script that reconstructs attacker-controlled hostnames from fragmented strings. It fetches a platform-specific binary over HTTPS from these dynamically constructed hosts, writes it to temporary system cache-like locations, sets executable permissions, and spawns it detached via shell commands. No signature or hash verification is performed on the binary, enabling arbitrary code execution. The package employs environment variable checks for evasion and uses a DNS TXT record covert channel as a fallback delivery mechanism. The fetch hosts are unrelated to the legitimate publisher, indicating a supply chain compromise or malicious package insertion.

This malicious package enables remote attackers to execute arbitrary code on the host system by fetching and running attacker-controlled binaries without verification. The use of disguised filenames and evasion techniques increases the risk of stealthy persistence and complicates detection. This can lead to system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove version 35.9.3 of delivery-ci-unit from their environments and avoid using this package until a trusted, clean version is released. Monitor for any unexpected binaries or processes spawned from temporary cache locations as described. Verify package integrity and source before installation.