The devplatform-rest-resources-v1 npm package version 35.2.3 includes malicious functionality where its index.js loads a bootstrap script that selects a platform-specific endpoint and downloads an opaque native binary over HTTPS from attacker-controlled Cloudflare Workers subdomains, with a DNS TXT fallback to a suspicious domain. The binary is saved to temporary directories under disguised filenames, permissions are set to executable, and it is spawned detached with output suppressed. The package uses array joins to obfuscate C2 hostnames and fallback domains to evade static scanners. It also implements execution gating and respects certain environment variables to appear as legitimate diagnostic or analytics activity. No signature verification or version pinning is performed, meaning the payload can be changed at will by the attacker. This results in arbitrary code execution on every system that installs or requires this package.

This malicious package leads to arbitrary code execution on any system that installs or requires devplatform-rest-resources-v1 version 35.2.3. The attacker-controlled native binary can perform any actions with the privileges of the executing user, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation and lack of signature verification increase the risk of undetected compromise.

No official patch or remediation is currently documented. Users should immediately stop using devplatform-rest-resources-v1 version 35.2.3 and remove it from their environments. Verify all dependencies for malicious code and consider using trusted package sources and integrity verification mechanisms. Monitor for suspicious activity related to this package and block network connections to the identified attacker-controlled domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.