The devplatform-api-v1-endpoint npm package version 35.9.8 includes malicious code in _adapter.js that dynamically reconstructs command-and-control (C2) hostnames from split fragments to evade detection. It fetches an executable payload from obfuscated hosts (oob-worker.cf10*-*.workers.dev and *.dl.wel1.ru domains) via DNS TXT queries and base64-encoded chunks. The payload is saved to temporary directories with cover-story filenames, given executable permissions, and launched detached via shell commands without any hash or signature verification. A persistence marker file (.analytics_state) is used to throttle repeated payload execution approximately every 6.4 hours. This malicious delivery mechanism is unrelated to the package's stated SDK purpose.

The malicious code enables remote code execution on the host system by downloading and executing an unverified payload from attacker-controlled infrastructure. This can lead to unauthorized system compromise, persistence, and potential further malicious activity. The use of obfuscation and evasion techniques complicates detection and analysis.

No official patch or remediation guidance is currently available. Users should avoid using devplatform-api-v1-endpoint version 35.9.8. Investigate and remove this package if present, and monitor for suspicious activity related to the described payload execution behavior. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.