The devplatform-react-query-s3-client npm package (version 35.8.7) includes a malicious module that, upon import, loads a vendor script which selects a platform-specific binary payload path and downloads an unsigned, opaque binary from obfuscated Cloudflare Workers hosts or fallback DNS-TXT base64 encoded channels. The binary is saved to temporary directories with deceptive names mimicking .NET diagnostic tools, given executable permissions, and executed detached from the main process using shell commands. A duplicate dropper exists in telemetry-related code to load the payload alternatively. The package uses environment variables and decoy files to provide a false telemetry cover story and employs string obfuscation to hide network destinations. The payload delivery infrastructure and behavior are unrelated to any legitimate SDK functionality, indicating malicious intent.

The malicious package can execute arbitrary binaries on the host system with the privileges of the running process, potentially leading to full system compromise or unauthorized actions. The use of obfuscated network hosts and fallback channels complicates detection and analysis. The deceptive filenames and telemetry evasion techniques increase the likelihood of the payload remaining undetected. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. Users should immediately remove the devplatform-react-query-s3-client package version 35.8.7 from their environments and avoid installing it. Monitor for any unexpected binaries or processes spawned from temporary directories with suspicious names. Consider using trusted package sources and verifying package integrity before installation. Stay updated with vendor advisories or security community reports for any future remediation.