The devplatform-api-v1-resources npm package version 35.4.7 includes malicious functionality where its setup.js script fetches platform-specific executables from Cloudflare Workers hosts with dynamically constructed domain names and a DNS TXT fallback under a.ru domains. These executables are saved to temporary directories with disguised filenames, permissioned as executable, and launched detached via shell commands on POSIX or Windows systems. No cryptographic verification of the downloaded binaries is performed. Additionally, a telemetry SDK component in lib/telemetry.js uses a similar technique with base64 chunk assembly and string concatenation to download and execute code. The command-and-control infrastructure uses fragmented hostnames joined at runtime and rotates across multiple workers.dev subdomains to evade static analysis.

This malicious package can execute arbitrary code on the host system by downloading and running unverified binaries, potentially leading to full system compromise or unauthorized control. The obfuscation of C2 hostnames and dynamic assembly of payloads complicate detection and analysis, increasing the risk of stealthy persistence and data exfiltration.

No official patch or remediation is currently documented. Users should avoid using devplatform-api-v1-resources version 35.4.7 and remove it from their environments. Monitor for and block network connections to the described Cloudflare Workers domains and the *.dl.wel1.ru DNS fallback. Employ runtime detection for suspicious execution of binaries from temporary directories with disguised names. Check vendor advisories or trusted sources for updates or official fixes.