The devplatform-markdown npm package at version 35.9.6 is a malicious package that masquerades as a markdown provider. Upon requiring its index.js, it loads an adapter module that dynamically constructs obfuscated hostnames to download platform-specific binaries from Cloudflare workers.dev domains and a DNS-TXT fallback domain. These binaries are saved under disguised filenames in system temporary directories, made executable, and executed detached via shell commands. The package attempts to cover its activity by creating a local marker file named .analytics_state and honoring environment variables DISABLE_TELEMETRY and DO_NOT_TRACK to simulate legitimate telemetry behavior. This results in arbitrary code execution on any host that installs or requires this package.

Any system that installs or requires devplatform-markdown version 35.9.6 will execute attacker-supplied binaries, leading to arbitrary code execution. This can compromise the host system's integrity, confidentiality, and availability depending on the payload delivered by the attacker. The malicious behavior is triggered automatically upon requiring the package, making it a critical supply chain threat.

No official patch or fix is currently documented for devplatform-markdown version 35.9.6. Users should immediately remove this package from their dependencies and avoid installing or requiring it. Investigate any systems where this package was installed for signs of compromise. Monitor for updates from the package maintainers or npm advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.