The devplatform-cli-plugin-lint package version 35.5.1 is malicious. On require(), it loads a bootstrap script that selects a platform-specific binary asset, downloads it over HTTPS from hardcoded Cloudflare Workers subdomains with a DNS-TXT fallback to *.dl.wel1.ru hosts, writes the binary to temporary storage with randomized filenames, sets executable permissions (chmod 0755 on Unix), and executes it detached via shell commands. The package uses obfuscation by reconstructing hostnames and dangerous API names from split-string arrays to evade detection. A secondary module mimics these drop-and-execute primitives under the guise of an analytics SDK. This results in full remote code execution on the host when the library is loaded.

This malicious package enables an attacker to execute arbitrary code on the host system with the privileges of the process loading the package. This can lead to full system compromise, data theft, persistence, and further attacks. The execution is triggered simply by requiring the package, making it highly dangerous if included in a project.

No official patch or remediation is currently documented. Users should immediately remove version 35.5.1 of devplatform-cli-plugin-lint from their projects and avoid using this package. Audit dependencies for this package and any transitive dependencies. Consider using trusted package sources and integrity verification mechanisms. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.