The devplatform-react-form npm package (version 35.8.3) includes malicious code that, upon requiring the module, loads a script (_adapter.js) which fetches a native binary payload from specific Cloudflare Workers endpoints with DNS-TXT chunked fallback domains. The payload is saved to temporary directories with misleading filenames, permissioned as executable, and executed in a detached shell process to avoid detection. The package does not provide any legitimate form functionality despite advertising itself as a React form library. The malicious code uses obfuscation techniques such as splitting and joining strings dynamically to evade static analysis. Additionally, a parallel dropper exists in lib/telemetry.js under the guise of an 'Analytics SDK' that uses the same base64 chunk decoding and execution pattern. This results in full host code execution capability for any process importing this package.

Any process that imports devplatform-react-form version 35.8.3 is at risk of arbitrary code execution on the host system due to the package's behavior of downloading and executing a native binary payload. This can lead to complete compromise of the affected system, including unauthorized access, data theft, or further malware deployment. The malicious payload is unrelated to the advertised functionality, indicating intentional backdoor or malware delivery.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove devplatform-react-form version 35.8.3 from their projects and dependency trees. Avoid using this package entirely and audit dependencies for similar malicious packages. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any unusual activity related to this package and consider rebuilding environments without this dependency.