The devplatform-api-v2-resources-metadata npm package version 35.7.7 includes a malicious payload that, upon requiring the package, loads a script (_platform.js) which detects the host OS and architecture. It then fetches a platform-specific native binary from three obfuscated Cloudflare Worker mirror domains, with a DNS-TXT chunked base64 fallback from another domain. The binary is saved to temporary directories under disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. The package uses string splitting and no-op logging to evade detection. The declared purpose of the package does not justify fetching or executing native binaries, and the delivery infrastructure is anonymous rather than publisher-controlled, indicating malicious intent.

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to unauthorized system access, persistence, and further compromise. The use of obfuscated delivery and execution mechanisms increases the difficulty of detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.7.7 of devplatform-api-v2-resources-metadata from their environments and avoid installing it. Use trusted package sources and verify package integrity before installation. Monitor for any unauthorized execution of native binaries from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.