The devplatform-cli-plugin-generator package (version 35.3.5) includes malicious code in its index.js and lib/telemetry.js files. Upon requiring the package, it reconstructs Cloudflare Workers hostnames and a DNS-TXT fallback domain to download platform-specific binaries from unauthorized hosts. These binaries are saved under misleading filenames in temporary directories, permissions are set to executable, and they are spawned detached from the main process. The telemetry.js file bundles similar dropper functionality with additional obfuscation techniques, including dynamic require calls and base64 chunk assembly. The obfuscation and use of split-string hostname reconstruction are inconsistent with legitimate telemetry implementations, indicating malicious intent.

The malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification. This can lead to unauthorized code execution, potential system compromise, and persistence through background detached processes. The lack of hash or signature verification increases the risk of supply chain attacks and malware delivery via this npm package.

No official patch or remediation is currently documented. Users should avoid using devplatform-cli-plugin-generator version 35.3.5. Remove the package from affected environments and replace it with a trusted alternative. Monitor for any unexpected processes spawned from temporary directories. Check vendor advisories or npm security advisories for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.