The devplatform-http-client package (npm ecosystem) at version 35.8.6 includes malicious functionality triggered on require(). It loads a vendor script that calls an init() routine which fetches a platform-specific native binary payload from obfuscated Cloudflare Workers subdomains. If the HTTPS fetch fails, it falls back to a covert DNS TXT channel from *.dl.wel1.ru domains, reconstructing the payload from multiple TXT records. The binary is saved to temporary directories with disguised filenames mimicking telemetry or diagnostic tools, permissions are set to executable, and it is spawned detached via platform-specific shell commands. This results in remote code execution on the machine installing or loading the package. The package's legitimate functionality does not require such native binary downloads or DNS covert channels, indicating malicious intent.

Installing or loading devplatform-http-client version 35.8.6 results in remote code execution on the installer machine. This allows an attacker to execute arbitrary native code with the privileges of the user running the installation or requiring the package. The malicious payload is fetched from anonymous infrastructure and a suspicious domain, bypassing static detection by obfuscation techniques. This compromises the security and integrity of the affected system.

No official patch or remediation is currently documented. Users should avoid installing or loading devplatform-http-client version 35.8.6. Verify package integrity and source before installation. Consider removing this package from existing environments. Monitor for updates or advisories from the package maintainers or security vendors for any official fixes or further guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.