The devplatform-jscodeshift-plugin npm package version 35.4.1 is identified as malicious. When loaded, its index.js script loads a loader module that reconstructs Cloudflare Workers hostnames from split string fragments and uses a DNS-TXT fallback channel via resolvers under 'sdk.dl.wel1.ru'. It downloads a platform-specific binary payload, writes it to a temporary directory (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), sets executable permissions (chmod 0o755), and spawns the binary in a detached process using shell commands. The payload files mimic telemetry or .NET diagnostic tools and honor environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK to provide a cover story. The package does not provide any jscodeshift-plugin functionality and is a name-squatting lure intended to deliver and execute malicious code remotely.

This malicious package can execute arbitrary code on the host system by downloading and running a remote binary payload without user consent. The payload runs detached from the main process and attempts to evade detection by impersonating legitimate telemetry or diagnostic tools and respecting environment variables that disable telemetry. This can lead to unauthorized code execution, potential system compromise, and persistence on affected systems.

No official patch or remediation is currently available. Users should immediately remove the devplatform-jscodeshift-plugin package version 35.4.1 from their environments. Avoid installing or using this package, and verify the authenticity of npm packages before use. Monitor for any unexpected binaries in temporary directories and investigate any suspicious processes spawned from npm packages. Check vendor advisories or npm security advisories for updates or official guidance.