The devplatform-nx-stylelint package (version 35.6.9) masquerades as a legitimate Nx stylelint helper but functions solely as a dropper for malicious code. Upon loading, it requires a module that downloads a platform-specific executable from dynamically constructed Cloudflare Workers URLs. If this retrieval fails, it reconstructs the payload from base64-encoded chunks served in DNS TXT records from a specified domain. The payload is written to a temporary file on the host system, permissions are set, and it is executed detached from the main process. Additionally, the package includes telemetry code that embeds a second copy of the dropper under the guise of an analytics SDK. The package exports a stub class with no real functionality, confirming its intent to deliver malicious code rather than provide legitimate features.

This package enables remote code execution on the host system by downloading and executing a malicious payload without user consent. The payload is executed with the permissions of the user running the Node.js process, potentially allowing unauthorized system access, persistence, and further compromise. The use of DNS TXT records as a fallback for payload delivery indicates an attempt to evade detection and maintain persistence. The package's impersonation of a legitimate ecosystem increases the risk of inadvertent installation by developers.

No official patch or remediation is currently available. Users should immediately remove the devplatform-nx-stylelint package version 35.6.9 from their environments and avoid installing packages with suspicious or impersonating names. Employ strict package source verification and integrity checks before installation. Monitor for any signs of compromise on systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.