The devplatform-s3-client npm package version 35.9.5 includes malicious code in its main entry (_bridge.js) that constructs Cloudflare Workers hostnames from fragmented strings to download a platform-specific binary via HTTPS. This binary is saved to temporary directories under decoy names and executed with elevated permissions. If HTTPS downloads fail, the code uses a covert DNS-TXT channel to reconstruct and execute a base64-encoded binary. A persistence mechanism prevents repeated execution across imports. This malicious behavior is unrelated to the package's purported S3 client functionality and results in full system compromise.

Any system with devplatform-s3-client version 35.9.5 installed or running is considered fully compromised. The attacker gains persistent remote code execution capabilities, potentially allowing full control over the system. All secrets and keys stored on the compromised system are at risk and must be rotated immediately from a secure, uncompromised device. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the devplatform-s3-client package version 35.9.5 is required. All secrets and keys stored on the compromised system must be rotated from a separate, secure device. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild is recommended. There is no official patch or fix available; the vendor has not provided remediation guidance. Users should avoid using this package version and verify the integrity of any dependencies.