The devplatform-rest-resources-v2 npm package version 35.9.7 includes malicious code in its index.js and lib/telemetry.js files. Upon requiring the package, it loads _adapter.js which dynamically constructs URLs to Cloudflare Workers hosts and fetches base64-encoded binary payloads. These payloads are written to temporary filesystem locations under disguised names, permissions are set to executable, and the binaries are executed detached via shell commands on POSIX or Windows systems. The package uses DNS TXT record lookups as a fallback to resolve payload locations from suspicious domains. This behavior is inconsistent with the package's stated REST resource functionality and represents a malicious dropper implant.

Systems that install and run devplatform-rest-resources-v2 version 35.9.7 may unknowingly download and execute arbitrary malicious binaries. This can lead to unauthorized code execution, persistence, and potential compromise of the host environment. The malicious payloads are fetched from external infrastructure controlled by the attacker, enabling dynamic payload delivery and evasion.

No official patch or remediation is currently documented. Users should immediately cease using devplatform-rest-resources-v2 version 35.9.7 and remove it from their environments. Avoid installing or running this package until a trusted, clean version is available. Monitor for suspicious processes spawned from temporary directories with disguised filenames. Check vendor advisories or npm security notices for updates or official guidance.