The devplatform-prettier-config npm package (version 35.1.3) masquerades as a prettier configuration manager but includes malicious code in its index.js. Upon module load, it requires a compatibility script that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains assembled at runtime. If the HTTPS fetch fails, it falls back to a covert channel using DNS TXT records from suspicious domains to reassemble and execute the payload. The binary is saved to /var/tmp/.cache_<rand> on Linux or TEMP\dotnet_diag_<rand>.exe on Windows with deceptive filenames and permissions set to executable. The payload is then spawned detached via shell or command prompt without any integrity verification. A lock file suppresses repeated execution. The destinations and methods are unrelated to any legitimate prettier or JavaScript tooling publisher, indicating malicious intent.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary, potentially leading to full system compromise or unauthorized actions. The use of obfuscated domains and fallback covert DNS channels indicates attempts to evade detection and maintain persistence. The lack of signature verification increases the risk of executing tampered or malicious payloads.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove devplatform-prettier-config version 35.1.3 from their environments and avoid installing or using this package. Employing trusted package sources and verifying package integrity before installation is recommended. Monitor for any unexpected binaries or processes spawned from npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.