The devplatform-po-transformer package version 35.1.8 includes a malicious mechanism triggered on import of its main entry point. It detects the OS and architecture, then dynamically assembles Cloudflare Workers hostnames to download an opaque binary payload. If that fails, it uses a DNS-TXT record covert channel to reconstruct base64-encoded payload chunks. The payload is saved to temporary directories with misleading filenames, given execute permissions, and launched detached from the Node.js process, enabling the remote operator to maintain arbitrary persistent code execution on the infected system. No hash or signature verification is performed on the downloaded payload, and the download hosts are unrelated to the package publisher, indicating a supply chain compromise or malicious package insertion.

This malicious package allows an attacker to execute arbitrary code persistently on the host system where the package is installed. The execution is detached from the parent process, making detection and termination more difficult. The lack of integrity checks on the downloaded payload increases the risk of further compromise. This can lead to full system compromise, data theft, or further malware deployment depending on the attacker's intent.

There is no official patch or remediation available for this malicious package version 35.1.8. Users should immediately remove this package from their environments and avoid installing it. Verify package integrity and source before installation, and consider using trusted package registries or internal mirrors. Monitor for any signs of compromise on systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.