The devplatform-nx-pvm npm package (version 35.2.9) includes a malicious module (_compat.js) that, upon require(), fetches a platform-specific binary from hardcoded attacker-controlled HTTPS hosts. It writes the binary to temporary storage with disguised filenames, sets executable permissions, and executes it detached via shell commands. To evade static detection, the C2 hostnames are constructed dynamically from split strings. If HTTPS retrieval fails, the code falls back to a covert DNS TXT channel to download base64-encoded payload chunks, which it concatenates, decodes, and executes. The package checks for telemetry opt-out environment variables to avoid execution in some environments. The main index.js unconditionally requires this malicious module, causing automatic execution of the attacker binary on installation and import.

This malicious package leads to automatic execution of attacker-controlled binaries on any system that installs and imports devplatform-nx-pvm version 35.2.9. This can result in full compromise of the affected system, unauthorized code execution, potential data theft, persistence, and further malicious activity. The stealth techniques used (dynamic hostname assembly, fallback covert DNS channel, telemetry opt-out checks) increase the difficulty of detection and mitigation.

No official patch or remediation is indicated in the provided data. Users should immediately remove and avoid installing devplatform-nx-pvm version 35.2.9. Audit existing projects for this package and replace it with trusted alternatives. Monitor for suspicious network activity related to the described C2 hosts. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates. Consider restricting network access to the described domains and implement supply chain security measures to prevent installation of malicious packages.