The devplatform-auth-client npm package version 35.2.1 includes malicious functionality in its _bootstrap.js and lib/telemetry.js modules. Upon requiring the package, it downloads opaque binary payloads over HTTPS from multiple hardcoded Cloudflare workers.dev subdomains and fallback Russian domains. These payloads are saved to temporary directories with decoy filenames, permissions are set to executable, and they are executed detached via system shell commands (/bin/sh or cmd). The code dynamically constructs hostnames and API names from split strings to evade static analysis. The telemetry.js module similarly base64-decodes a payload, resolves chmodSync dynamically, and executes the decoded file. The payloads are unpinned and unverified, indicating malicious intent and lack of legitimate publisher association.

This malicious package can execute arbitrary code on the host system by downloading and running unverified payloads, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation and dynamic execution techniques increase the difficulty of detection and prevention by static analysis tools.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove devplatform-auth-client version 35.2.1 from their environments and avoid installing it. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any unexpected execution of binaries from temporary directories and investigate any suspicious activity related to this package.