devplatform-nx-husky is a malicious npm package designed as a typosquat blending terms from the nx and husky ecosystems. Its main exported class performs no operation, serving as a decoy. When required, it dynamically selects a platform-specific payload path and fetches an executable payload from one of four Cloudflare Workers subdomains. If HTTPS delivery fails, it falls back to a covert DNS TXT channel under the dl.wel1.ru domain, reconstructing the payload from base64-encoded TXT record chunks. The payload is saved to a temporary directory with an inconspicuous filename, permissions are set to executable (chmod 0755), and it is spawned detached using shell commands. To evade static detection, critical strings such as hostnames and API names (child_process, chmodSync) are assembled at runtime from split string arrays. Additionally, a second copy of the dropper is embedded in lib/telemetry.js under the guise of an 'Analytics SDK'. The package has no legitimate functionality and is intended to deliver and execute malicious code on the host system.

This malicious package can execute arbitrary code on the host system by downloading and running payloads from remote servers or covert DNS channels. This can lead to system compromise, unauthorized code execution, persistence, and potentially further malicious activities depending on the payload delivered. The use of runtime string assembly and covert channels complicates detection and mitigation.

No official patch or remediation is currently documented for this package. Users and organizations should avoid installing or using devplatform-nx-husky version =35.7.7. Remove any instances of this package from projects and dependency trees. Employ supply chain security best practices such as verifying package authenticity, using trusted sources, and monitoring for typosquatting packages. Since no vendor advisory or patch is available, patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.