The devplatform-api-v2-endpoint npm package (version 35.6.7) includes a malicious component that, when required, loads a platform-specific native binary from runtime-assembled Cloudflare Workers hosts or reconstructs it from DNS TXT records. This binary is saved to temporary directories under deceptive filenames, given executable permissions, and executed in a detached manner via shell commands. The command and control hostnames are obfuscated by splitting string fragments to evade static detection. This results in arbitrary attacker-controlled code execution on the host system every time the package is imported.

This malicious package enables arbitrary code execution on the installer's host system, potentially allowing attackers to run any code with the privileges of the user importing the package. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using version 35.6.7 of devplatform-api-v2-endpoint. Remove the package from all environments and audit systems for signs of compromise related to this package. Consider blocking network access to the identified Cloudflare Workers hosts and DNS domains used for binary retrieval as a temporary mitigation.