The delivery-ci-upgrade-form npm package at version 35.5.9 includes malicious code that, upon module load, requires a runtime script which detects the platform and architecture, then downloads an OS-specific binary from obfuscated Cloudflare Worker URLs and fallback domains. The downloaded payload is stored in temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. Additionally, a telemetry module acts as a parallel dropper, writing base64-decoded payload chunks to disk and executing them. The package employs string-splitting and dynamic require calls to evade static detection and analysis.

Systems that install and run delivery-ci-upgrade-form version 35.5.9 risk executing malicious binaries that could compromise system integrity, confidentiality, and availability. The malicious payload runs with the permissions of the executing user and could lead to arbitrary code execution, persistence, and potential further compromise. The obfuscation and use of multiple fallback download hosts complicate detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove delivery-ci-upgrade-form version 35.5.9 from their environments and avoid installing it. Investigate any systems where this package was installed for signs of compromise and remove any downloaded payloads or spawned processes. Monitor for suspicious activity related to the described domains and filenames. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.