The devplatform-s3-uploader npm package version 35.4.4 includes malicious code that triggers on require(). It loads a helper script that selects a platform-specific asset path and fetches a native binary from four hardcoded Cloudflare Workers domains, with a DNS-TXT fallback mechanism that reassembles base64-encoded chunks from unrelated domains. The fetched binary is saved under a deceptive filename in a temporary directory, permissions are set to executable, and it is executed detached via shell commands on Unix or Windows. No hash or signature verification is performed on the downloaded binary. The package constructs hostnames and API identifiers dynamically to evade static detection. Additionally, a secondary module named lib/telemetry.js acts as a parallel dropper with similar capabilities. These behaviors are unrelated to the advertised S3 uploader functionality and indicate a malicious package compromise.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The execution of opaque binaries from attacker-controlled infrastructure bypasses normal supply chain trust and could facilitate further malicious activities. The lack of integrity checks and obfuscation techniques increase the risk of undetected exploitation.

Users should immediately stop using devplatform-s3-uploader version 35.4.4 and remove it from their environments. Since no official patch or remediation is indicated, avoid installing or updating to this version. Verify dependencies and audit package sources carefully. Consider using package integrity verification tools and restrict execution permissions for npm packages. Monitor for any signs of compromise related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.