The 'deposits-common' npm package version 35.5.4 includes a malicious loader implemented in _support.js that reconstructs obfuscated hostnames and attempts to retrieve payloads over HTTPS from worker.dev domains. If HTTPS retrieval fails, it falls back to a DNS-TXT covert channel using multiple dl.wel1.ru subdomains, resolving numbered TXT records and base64 concatenating chunks to reconstruct the payload. The payload is written to temporary directories with disguised filenames (e.g., dotnet_diag_<rand>.exe on Windows) and executed detached via shell commands without any hash or signature verification. The loader respects environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK to avoid telemetry and sandbox detection, and writes a state file to prevent re-execution. The delivery infrastructure and behavior are unrelated to the package's declared functionality.

This malicious code enables arbitrary code execution on systems that install and run the affected package version, potentially allowing attackers to execute arbitrary payloads without user consent or verification. The use of covert DNS-TXT channels and obfuscated hostnames complicates detection and analysis. The malware's evasion of telemetry and sandbox detection increases the risk of persistent undetected compromise.

No official patch or remediation guidance is provided in the available data. Users should avoid using the affected version 35.5.4 of the 'deposits-common' package. Verify package integrity before installation and consider removing or replacing this package if found in your environment. Monitor for suspicious network activity related to the described domains and payload execution patterns. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.