The devplatform-po-loader package version 35.1.8 is a malicious npm package that functions as a dropper. When loaded, it dynamically reconstructs obfuscated hostnames to download platform-specific binaries over HTTPS from Cloudflare Workers endpoints. These binaries are saved under disguised filenames in temporary directories, permissioned as executable, and spawned detached via shell commands. If the primary download method fails, it uses a covert channel by querying DNS TXT records from specific domains to retrieve base64-encoded payload chunks, which it reassembles and executes. The package includes a marker file and comments to avoid detection in continuous integration environments. It contains no legitimate library code and solely serves to deliver and execute malicious payloads.

This malicious package can execute arbitrary binaries on the host system with the privileges of the user running the Node.js process. The downloaded payloads are platform-specific and executed detached, potentially enabling persistent and stealthy compromise. The use of obfuscated endpoints and covert DNS channels complicates detection and analysis. This poses a significant risk of remote code execution and system compromise for users who install or require this package.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid using devplatform-po-loader version 35.1.8 entirely. Users should remove this package from their dependencies and verify that no related binaries or marker files remain on their systems. Employ supply chain security best practices such as verifying package provenance, using trusted registries, and scanning dependencies for malicious content. Monitor for any suspicious processes or files matching the described behavior.