The delivery-ci-update-gitlab npm package version 35.7.5 includes a loader script that fetches a platform-specific executable from hardcoded Cloudflare Workers domains, saves it to temporary directories with disguised filenames, sets executable permissions, and spawns it detached via child_process.spawn. If the HTTPS fetch fails, it falls back to a DNS-TXT covert channel to retrieve base64-encoded binary chunks from specific resolver domains, reassembles the binary, and executes it. The package writes a .analytics_state stamp file and sets environment variables named DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK to frame the behavior as telemetry. The package metadata is placeholder with empty dependencies and no repository or author details, indicating malicious intent and impersonation of an internal CI/GitLab tool.

The malicious package can execute arbitrary unsigned binaries on the host system, potentially leading to full system compromise or unauthorized actions. The use of covert DNS channels for fallback retrieval increases stealth and resilience against network blocking. The disguise as telemetry may delay detection by security tools or administrators. There is no indication of active exploitation in the wild yet, but the capability to execute arbitrary code poses a high risk.

No official patch or remediation is currently available. Users should immediately remove the delivery-ci-update-gitlab package version 35.7.5 from their environments and avoid installing or using this package. Monitor for any unexpected processes spawned from temporary directories with disguised names. Since this is a malicious package impersonating a legitimate tool, verify package sources carefully and prefer official repositories. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.