The devplatform-react-hooks npm package version 35.5.7 includes malicious functionality triggered upon requiring its main entry point. It reconstructs hostnames for Cloudflare Workers dynamically and cycles through them to download a platform-specific binary. This binary is saved under a disguised filename in temporary directories (/var/tmp or %TEMP%), given executable permissions (0755), and executed detached via shell commands. The package attempts to disguise this behavior as telemetry collection and offers environment variable opt-outs, which do not prevent the malicious execution. An additional module with similar drop-and-execute behavior exists but is not reachable from the main entry. The package name and description do not reflect this malicious activity, indicating deliberate obfuscation.

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to full system compromise, data theft, persistence, or further malware deployment. The execution of a downloaded binary from external hosts poses a significant risk of remote code execution and unauthorized control over affected systems.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.5.7) of devplatform-react-hooks from their projects and dependency trees. Avoid installing or using this package version. Monitor for any suspicious binaries or processes spawned from temporary directories matching the described patterns. Consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.