The devplatform-cli package (version 35.7.4) includes code that, when required or installed, loads a module that constructs Cloudflare Workers hostnames from fragmented strings and falls back to downloading base64-encoded binaries from multiple suspicious domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). These binaries are saved to temporary directories under disguised filenames, permissions are set to executable, and the binaries are executed detached from the main process. A sibling telemetry module duplicates this behavior with additional obfuscation. The downloaded binaries are opaque and unverified, leading to arbitrary code execution with the privileges of the user installing or requiring the package.

Installing or requiring devplatform-cli version 35.7.4 results in arbitrary code execution on the host system under the installer's user context. This can lead to full compromise of the affected system, data theft, persistence, or further malicious activity. The malicious payload is fetched from anonymous and unrelated serverless hosts, increasing the risk of unknown and potentially evolving threats.

No official patch or remediation is currently documented. Users should avoid installing or requiring devplatform-cli version 35.7.4. If the package is already installed, remove it immediately. Monitor for any environment variables that might opt out of the malicious behavior, but do not rely on this as a mitigation. Check vendor advisories or trusted security sources for updates or official fixes. Consider using trusted package sources and verifying package integrity before installation.