The devplatform-nx-devkit package (version 35.8.5) is a malicious npm package that includes a hidden _shim.js file invoked by index.js. This _shim reconstructs multiple obfuscated hostnames and downloads a platform-specific binary from these hosts. The binary is saved under temporary directories with decoy names and executed detached via shell commands. Although a comment mentions SHA-256 integrity verification, no such check is performed. The package contains environment variable checks and a telemetry.js module frame to disguise the malicious dropper as analytics, but it contains no actual devkit functionality or dependencies.

This package enables remote code execution on the host system by downloading and executing an unverified binary from attacker-controlled servers. This can lead to full system compromise, persistence, and further malicious activity. The lack of integrity verification increases the risk of tampering or substitution of the binary. The malicious behavior is triggered simply by requiring the package, posing a high risk to any project that installs and uses this version.

Avoid using devplatform-nx-devkit version 35.8.5. Remove this package from any projects and replace it with a trusted alternative. Since no patch or fix is available, do not use this package version. Monitor for any unexpected binaries in temporary directories and investigate any suspicious processes spawned by development tools. Consider scanning your environment for this package and the associated dropped binaries.