The [email protected] npm package includes a malicious loader in index.js that fetches a platform-specific binary from anonymous Cloudflare Workers subdomains constructed at runtime via string splitting to evade static analysis. It uses a DNS TXT record fallback mechanism to reassemble a base64 payload from numbered TXT records under sdk/ext/pkg/net.dl.wel1.ru. The binary is saved to temporary directories with disguised filenames, permissions are set to executable (chmod 0755), and it is spawned detached from the main process using shell commands on Unix or cmd on Windows. A cache mechanism prevents repeated downloads within a TTL. Additionally, a dormant secondary dropper with similar behavior exists in lib/telemetry.js but is not currently invoked. The payload is unpinned and unverified, sourced from opaque, author-controlled infrastructure.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and further malicious activity. The obfuscation and use of anonymous infrastructure complicate detection and analysis. The presence of a dormant secondary dropper increases the risk of future exploitation if activated.

No official patch or remediation is currently documented. Users should avoid using devplatform-api-v2-resources version 35.3.8. Remove the affected package from projects and replace it with a trusted alternative. Monitor for suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.