The devplatform-api-v2-resource-mock package at version 35.4.1 acts as an import-time dropper. Its main entry point requires a compatibility script that assembles C2 hostnames at runtime to evade static analysis. It performs HTTPS GET requests to attacker-controlled subdomains and falls back to DNS-TXT queries if needed. The downloaded payload is saved to temporary directories with names mimicking diagnostic tools, made executable, and executed detached via shell commands on Linux/macOS or Windows. No integrity checks are performed on the payload. A marker file records the process ID to prevent repeated downloads within approximately 6 hours, providing persistence across multiple imports. The code also checks environment variables to disguise its activity as telemetry data collection. Loading this package results in arbitrary code execution on the host.

Loading the affected package version leads to remote code execution on the host system with the privileges of the user running the Node.js process. The malicious payload is fetched and executed without verification, enabling attackers to run arbitrary code. The persistence mechanism prevents repeated downloads for about 6 hours, maintaining a foothold. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using or importing devplatform-api-v2-resource-mock version 35.4.1. Verify the integrity and provenance of npm packages before use. Consider removing or replacing this package if already installed.