The devplatform-react-utils package version 35.6.9 includes malicious functionality where the index.js loads a helper script that reconstructs Cloudflare Workers hostnames via array-join string splitting to download platform-specific binaries. These binaries are written to temporary directories with randomized hex suffixes and disguised filenames, then made executable and spawned detached via shell commands. A DNS-TXT fallback channel decodes base64 multi-record TXT responses from a malicious domain to retrieve payload bytes. The telemetry.js module duplicates these fetch-decode-chmod-spawn operations. This behavior is attacker infrastructure masquerading as legitimate library code.

This malicious code enables remote attackers to execute arbitrary binaries on affected systems, potentially leading to full system compromise or persistent unauthorized access. The use of covert DNS-TXT channels for payload delivery complicates detection and mitigation. The presence of disguised filenames and randomized staging paths further obscures the malicious activity from defenders.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using devplatform-react-utils version 35.6.9 and consider removing or replacing the package. Monitor for suspicious processes spawned from temporary directories and network traffic to suspicious domains such as sdk.dl.wel1.ru. Employ runtime protection to detect unauthorized binary execution.