The devplatform-nx-spa package version 35.8.7 includes malicious functionality where its index.js loads a support script that selects a platform-specific native binary. This binary is fetched from one of four Cloudflare Workers subdomains or, failing that, reconstructed from base64-encoded DNS TXT records under *.dl.wel1.ru. The binary is written to /var/tmp or %TEMP% with obfuscated filenames, permissioned for execution, and launched detached via shell commands. Hostnames are dynamically assembled to evade detection, and a '.analytics_state' file is used as a cover mechanism. An unreferenced telemetry module duplicates these drop-and-execute behaviors under an analytics SDK guise.

This malicious package can execute arbitrary native code on the host system by downloading and running binaries without user consent, potentially leading to full system compromise or unauthorized actions. The use of obfuscation and fallback mechanisms increases the difficulty of detection and removal.

No official patch or remediation is currently available. Users should avoid using devplatform-nx-spa version 35.8.7 and remove it from their environments. Monitor for and block network connections to the identified Cloudflare Workers subdomains and the *.dl.wel1.ru DNS domain. Employ endpoint detection tools to identify and quarantine the dropped binaries and related artifacts.