The devplatform-hooks package (npm ecosystem) at version 35.2.1 includes code in index.js that loads _init.js, which dynamically constructs obfuscated URLs hosted on Cloudflare Workers to fetch an executable payload. If the HTTPS fetch fails, it uses a DNS-TXT record covert channel querying specific domains to retrieve base64-encoded binary chunks, which are concatenated and decoded. The binary is saved to temporary directories with disguised names and executed detached using platform-specific shell commands, enabling remote code execution triggered by simply installing or importing the package.

This malicious package enables remote code execution on any system that installs or imports devplatform-hooks version 35.2.1. The attacker can execute arbitrary code with the privileges of the user running the package, potentially leading to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing devplatform-hooks version 35.2.1. Remove any installations of this package and audit systems for signs of compromise. Monitor for updates from the package maintainers or npm security advisories for any official fixes or removals. Since this is a malicious package, consider blocking it in your package management policies.