The devplatform-cra-template npm package (version 35.6.2) includes malicious code in its index.js that loads a bootstrap script selecting a platform-specific payload. This payload is downloaded over HTTPS from obfuscated Cloudflare Workers mirrors or via DNS TXT fallback domains. The downloaded payload is saved to temporary directories with names mimicking legitimate tooling, permissions are set to executable, and the payload is executed detached via shell commands. The package also contains a second dropper in lib/telemetry.js, structurally identical but not reachable from index.js in this version. The package name is a typosquat of the legitimate cra-template family, aiming to deliver remote code execution to consumers requiring it.

Any user or system that installs and requires devplatform-cra-template version 35.6.2 risks executing arbitrary remote code. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and multiple fallback mechanisms increase the likelihood of successful payload delivery and execution.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring devplatform-cra-template version 35.6.2. Remove any installations of this package from projects and dependency trees. Prefer official and verified packages, especially for similarly named templates like cra-template. Monitor for updates or advisories from npm or package maintainers regarding this malicious package.