The devplatform-create-nx-spa package at version 35.4.9 includes an index.js entry point that requires a hidden _bridge.js module. This module dynamically constructs hostnames for Cloudflare Workers and fallback DNS-TXT channels to download an unsigned binary payload. The payload is saved to a temporary file location on Unix or Windows systems, permissions are set to executable, and it is spawned detached from the main process. The malicious activity is gated by a timestamp file and obfuscated by splitting strings to evade static detection. The package masquerades as a lightweight Nx SPA scaffolder but executes attacker-controlled code on installation.

This malicious package enables remote code execution on the host system where it is installed, potentially allowing attackers to run arbitrary unsigned binaries. This can lead to full system compromise, data theft, or further malware deployment. The attack is stealthy, using obfuscation and timing gates to avoid detection during installation.

No official patch or remediation is currently available for this malicious package version. Users should immediately uninstall devplatform-create-nx-spa version 35.4.9 and avoid installing packages from untrusted sources. Use verified and trusted npm packages only. Monitor for any suspicious processes or files created in temporary directories matching the described behavior and conduct incident response if infection is suspected.