The devplatform-api-clients package version 35.6.8 includes a malicious setup.js script that downloads a native binary from obfuscated Cloudflare Workers endpoints and fallback DNS TXT-record hosts. The binary is saved to temporary directories under stealthy filenames, given executable permissions, and executed detached from the main process. The execution is gated by a marker file to prevent repeated runs and respects environment variables that disable telemetry to evade detection. This behavior is unexpected and inappropriate for a client SDK, indicating malicious intent.

This malicious package can execute arbitrary native code on the host system where it is installed, potentially leading to full system compromise, data theft, or persistence. The stealthy download and execution mechanism increases the risk of undetected compromise. No known exploits in the wild are reported yet.

No official patch or remediation guidance is provided. Users should immediately remove version 35.6.8 of devplatform-api-clients from their environments and avoid installing this package version. Monitor for any unexpected binaries or processes spawned from npm packages. Consider using trusted package sources and verifying package integrity before installation.