The devplatform-nx-ts package version 35.1.3 loads a compatibility script that downloads a platform-specific binary from Cloudflare Workers hosts with dynamically assembled domain names and a DNS-TXT base64 fallback channel. The binary is saved to temporary storage with a disguised filename, permissions are set to executable, and it is spawned detached from the main process. No cryptographic verification or version pinning is performed. The package also contains a telemetry module that can similarly decode, write, and execute a binary, but this module is not invoked in the current tarball. The malicious activity is obfuscated under the guise of telemetry and analytics state checks.

This malicious package can execute arbitrary binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The lack of signature verification and dynamic fetching from external sources increases the risk of executing untrusted code. The disguised filenames and detached execution make detection and analysis more difficult.

No official patch or remediation guidance is available for this malicious package. Users should immediately remove version 35.1.3 of devplatform-nx-ts from their environments and avoid installing this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected binaries or processes spawned from temporary directories. Consider using package integrity tools and supply chain security measures to prevent installation of malicious npm packages.