The devplatform-po-declaration-generator npm package version 35.2.7 includes malicious code that unconditionally loads a module which fetches platform-specific native binaries from suspicious Cloudflare Workers URLs. The binaries are saved under temporary file paths with misleading names, permissions are set to executable, and they are executed detached from the main process. The code uses obfuscation techniques such as dynamic string assembly and indirect require calls to evade detection. No hash or signature verification is performed on the downloaded binaries, and the package's legitimate purpose does not require such behavior, indicating a malicious supply chain compromise.

This malicious behavior allows execution of arbitrary native code on the host system when the package is required, potentially leading to full system compromise, data theft, or persistence. The lack of integrity checks and use of anonymous hosting for binaries increases the risk of undetected malicious payload delivery. Since the package executes code outside the normal npm package scope, it bypasses typical JavaScript sandboxing protections.

No official patch or remediation is currently documented. Users should immediately stop using devplatform-po-declaration-generator version 35.2.7 and remove it from their environments. Verify dependencies and replace with trusted alternatives. Monitor for any unusual activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.