The devplatform-react-query-clients npm package version 35.7.7 includes code that, upon requiring the package, loads a module which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints with a DNS-TXT fallback to suspicious domains. The binary is saved with randomized dot-prefixed filenames in temporary directories, permissioned to be executable, and spawned detached via shell commands. Hostnames and API calls are obfuscated to evade static analysis. The dropper masquerades as telemetry or analytics modules with environment variable opt-out gates. This results in full-host remote code execution on any system that installs or imports this package. There is no CVSS score or vendor advisory available, and no patch links are provided.

Successful installation or import of devplatform-react-query-clients version 35.7.7 leads to arbitrary code execution on the host system due to the download and execution of unauthenticated binaries from attacker-controlled infrastructure. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or importing devplatform-react-query-clients version 35.7.7. Consider removing the package from existing environments and monitor for updates from the package maintainers or security advisories.