The devplatform-sdk npm package version 35.6.1 includes a malicious payload embedded in its index.js, which loads a polyfill script that auto-invokes a start function. This function dynamically constructs hostnames to fetch a native binary payload from Cloudflare Workers and DNS TXT fallbacks. The binary is saved under temporary system directories with names resembling system cache or diagnostic files, permissions are set to executable, and it is launched detached from the main process. Evasion mechanisms include obfuscated hostname assembly, suppression of standard error output, and a timestamp-based file to prevent repeated execution. The package falsely advertises itself as a lightweight SDK wrapper but effectively acts as a dropper for arbitrary attacker-controlled native code.

This malicious package enables arbitrary native code execution on the affected system, potentially allowing attackers to execute any code with the privileges of the user running the npm package. The evasion techniques and silent execution increase the risk of undetected compromise. This can lead to system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing or using devplatform-sdk version 35.6.1. Remove any installations of this version immediately and audit systems for signs of compromise. Use trusted sources and verify package integrity before installation. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.