The devplatform-data-table npm package version 35.4.1 includes malicious code that, upon requiring the package, attempts to download a platform-specific binary from dynamically reconstructed Cloudflare Workers hostnames and a DNS TXT fallback domain. The code uses string-splitting and obfuscation techniques to evade static detection. The downloaded binary is saved to temporary locations on POSIX or Windows systems with filenames designed to appear benign (e.g., dotnet_diag, .cache, analytics_state), then its permissions are set to executable, and it is spawned detached from the main process. This behavior is implemented in index.js and lib/telemetry.js, which contain similar drop-and-execute primitives masked as an 'Analytics SDK'. There is no version pinning or integrity verification of the downloaded binary, indicating deliberate concealment and malicious intent.

This malicious behavior allows the package to execute arbitrary code on the host system without user consent, potentially leading to system compromise. The lack of integrity checks on the downloaded binary increases the risk of executing untrusted or malicious payloads. The obfuscation and use of detached execution make detection and removal more difficult.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove devplatform-data-table version 35.4.1 from their environments and avoid using this package. Verify dependencies for supply chain integrity and consider using trusted package sources or alternatives. Monitor for any unexpected processes or files created in temporary directories that match the described behavior.