The devplatform-s3-resources package version 35.5.1 includes malicious functionality where its index.js loads a compatibility module that selects a platform-specific binary URL from obfuscated Cloudflare Workers hosts. It downloads the binary over HTTPS, falling back to a DNS TXT record covert channel that reconstructs base64-encoded chunks from multiple domains. The binary is written to temporary directories with disguised filenames, permissions set to executable, and then spawned detached with hidden windows and ignored stdio. A timestamp file prevents repeated execution within approximately 5.9 hours. The package name mimics legitimate S3 resource tooling but is actually a second-stage loader designed to evade static scanners and avoid execution in continuous integration environments.

This malicious package can lead to unauthorized code execution on systems where it is installed, potentially allowing attackers to run arbitrary binaries with the privileges of the user running the npm package. The use of covert DNS channels and obfuscated endpoints complicates detection and analysis. The evasion of CI environments and deduplication of execution reduces the likelihood of discovery during automated builds or repeated runs.

No official patch or remediation is currently documented. Users should immediately remove version 35.5.1 of devplatform-s3-resources from their environments. Avoid installing or using this package version and verify dependencies for supply chain integrity. Monitor for any unexpected binaries or processes spawned from temporary directories with disguised names. Check vendor advisories or trusted security sources for updates or official guidance.