The devplatform-integrations-tests-lib package version 35.2.5 includes malicious code that, upon requiring the package, selects a platform-specific asset path and downloads a native binary from Cloudflare workers.dev hosts (e.g., oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback to domains like *.dl.wel1.ru. The binary is saved to temporary directories (/var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows), permissions are set to executable (chmod 0755), and it is spawned detached via shell commands (/bin/sh -c or cmd.exe). The package conceals the use of child_process by splitting the string 'child_process' and assembling it dynamically. The staging filenames (analytics_state, dotnet_diag_*.exe) mimic legitimate system artifacts to evade detection. This malicious download-chmod-spawn pattern is duplicated in the lib/telemetry.js module, providing a secondary execution path. The package name and telemetry framing serve as a cover for this dropper behavior.

This malicious package can execute arbitrary native code on the host system by downloading and running a binary from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and further malicious activities. The use of legitimate-looking filenames and obfuscation techniques increases the risk of evasion and prolonged undetected presence on affected systems.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove version 35.2.5 of devplatform-integrations-tests-lib from their environments and avoid installing it. Verify the integrity of dependencies and consider using trusted package sources or lockfiles to prevent installation of malicious packages. Monitor for any signs of compromise related to this package and conduct incident response if it was installed.