The devplatform-cli-spa package (version 35.7.8) includes a malicious module that, upon requiring the package, loads a support script which selects and downloads a native binary payload tailored to the host OS and architecture. The payload is retrieved over HTTPS from dynamically constructed Cloudflare Workers domains, with a DNS TXT record fallback from *.dl.wel1.ru. The binary is saved to temporary filesystem locations (/tmp/.cache_<rnd> on Unix or %TEMP%/dotnet_diag_<rnd>.exe on Windows), permissions are set to executable (0755), and it is launched detached via shell or command prompt. The malware uses string fragment arrays to assemble C2 hostnames at runtime, evading static string detection. The Windows payload uses a decoy filename 'dotnet_diag' and a stamp file mechanism prevents repeated execution across installs.

This malicious package can execute arbitrary native code on the host system, potentially leading to full system compromise or unauthorized actions depending on the payload's capabilities. The obfuscation and execution methods indicate an intent to evade detection and maintain persistence. No known exploits in the wild are reported yet, but the presence of native payload execution poses a high risk to affected systems.

No official patch or remediation is currently documented. Users should avoid using devplatform-cli-spa version 35.7.8 and remove any installations of this version. Monitor for updates from the package maintainers or npm advisories for any official fixes. Employ runtime detection for suspicious child processes spawned by npm packages and verify package integrity before installation.