The delivery-ci-validate npm package version 35.1.4 includes a malicious polyfill (_polyfill.js) that assembles obfuscated hostnames at runtime to fetch a platform-specific binary from Cloudflare Workers URLs without version pinning or integrity verification. If the primary fetch fails, it falls back to a DNS-TXT covert channel over subdomains of dl.wel1.ru to retrieve chunked base64-encoded payload bytes. The payload is written to a temporary directory with a misleading diagnostic filename, permissions are set to executable (0755), and it is spawned detached via shell commands (/bin/sh or cmd). This execution occurs automatically upon requiring or importing the package, without explicit lifecycle hooks. The delivered binary is attacker-controlled opaque code, and the evasion techniques used are inconsistent with legitimate telemetry or update mechanisms.

This malicious package allows remote attackers to execute arbitrary code on the host system automatically when the package is imported. The attacker-controlled binary can perform any actions permitted by the executing user, potentially leading to full system compromise, data theft, or persistence. The obfuscation and fallback communication channels hinder detection and analysis.

No official patch or remediation is currently documented. Users should immediately avoid using delivery-ci-validate version 35.1.4 and remove it from their environments. Monitor for any unexpected execution of binaries from temporary directories and consider rebuilding environments without this package. Check vendor advisories or trusted security sources for updates or fixes. Since no patch is confirmed, exercise caution and consider alternative packages.