The devplatform-api-endpoint package (npm) version 35.2.9 unconditionally loads a bootstrap script that fetches platform-specific binaries from obfuscated Cloudflare Workers hosts. These binaries are saved with masquerading filenames, given executable permissions, and run detached via child processes. Additionally, a DNS-TXT covert channel fallback mechanism retrieves base64-encoded executable payloads from TXT records under the dl.wel1.ru domain, which are concatenated, decoded, written to disk, and executed. The endpoint URLs are fragmented in the source code to evade static detection. The package advertises no legitimate functionality that justifies this behavior, indicating it is a malicious package designed to execute arbitrary code on the host system.

This malicious package can execute arbitrary code on the host system by downloading and running remote binaries without user consent. This can lead to full system compromise, unauthorized access, data theft, or further malware deployment. The use of obfuscated endpoints and covert DNS channels complicates detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove version 35.2.9 of devplatform-api-endpoint from their environments and avoid installing this package. Monitor for any usage of this package and replace it with trusted alternatives. Since no patch is available, the best mitigation is to block or uninstall the malicious package and audit systems for any signs of compromise.