The devplatform-jscodeshift-transforms npm package (version 35.9.5) includes a malicious loader (_shim.js) that downloads a platform-specific executable from obfuscated Cloudflare Workers hosts, saves it to temporary directories with disguised filenames, sets executable permissions, and spawns it detached via shell commands. If HTTPS download fails, it falls back to a DNS-TXT record covert channel to reconstruct the binary. The code uses string concatenation to evade static detection and environment variable checks to masquerade as telemetry or analytics software. The package name mimics an internal jscodeshift transforms wrapper to avoid suspicion.

This malicious package enables remote code execution on the host system by downloading and executing arbitrary binaries. The obfuscation and fallback covert channel increase the difficulty of detection and mitigation. This can lead to compromise of the affected system, unauthorized access, and potential further malicious activity.

No official patch or remediation is currently documented. Users should immediately remove version 35.9.5 of devplatform-jscodeshift-transforms from their environments. Avoid installing or requiring this package version. Monitor for unexpected binaries named like dotnet_diag_*.exe or .cache_* in temporary directories. Check for suspicious network activity to the indicated Cloudflare Workers hosts and the sdk.dl.wel1.ru domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.