The devplatform-cli-plugin-test package (version 35.4.5) includes malicious functionality triggered on require(). It selects a platform-specific asset and downloads a binary over HTTPS from hardcoded Cloudflare Workers hosts, with a DNS TXT base64 fallback domain under dl.wel1.ru. The binary is saved to temporary directories under names resembling legitimate diagnostic tools, given executable permissions, and executed detached from the main process. The command-and-control hostnames and fallback domains are dynamically reconstructed from split-string arrays at runtime to evade static detection. There is no hash or signature verification of the downloaded binary, and the package advertises itself as test fixtures while performing this drop-and-execute behavior.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary from attacker-controlled servers. This can lead to unauthorized system compromise, persistence, and potential further malicious activity. The use of obfuscated runtime hostname reconstruction and lack of integrity checks increases the risk of undetected compromise.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using devplatform-cli-plugin-test version 35.4.5. Remove any installations of this package and verify system integrity if it was used. Monitor for suspicious processes and network connections related to the described behavior. Check vendor or repository advisories for updates or removal notices.