The devplatform-select-user npm package (version 35.4.4) includes a malicious dropper that, upon require(), loads a JavaScript bridge (_bridge.js) which downloads a platform-specific native binary from hardcoded Cloudflare Workers subdomains. The binary is saved to temporary directories with cover-story filenames and executed detached via shell commands. Hostnames for the download are dynamically reconstructed to evade string-based detection. Additionally, a DNS fallback channel using TXT records under *.dl.wel1.ru is used to retrieve or exfiltrate chunked data if HTTPS is blocked. The package falsely advertises itself as a 'select user' UI helper, but its actual behavior enables attacker-controlled code execution on the host system.

Installing or importing devplatform-select-user version 35.4.4 results in execution of attacker-controlled native code on the host system, leading to full compromise potential. The malicious binary is downloaded and executed without user consent or legitimate functionality justification. The DNS fallback channel further enables covert communication for data exfiltration or command and control if HTTPS is blocked.

No official patch or remediation is currently available for this malicious package. Users and organizations should immediately remove devplatform-select-user version 35.4.4 from their projects and dependency trees. Avoid installing or importing this package. Employ supply chain security measures such as verifying package provenance and using trusted registries. Monitor for and block network connections to the identified Cloudflare Workers domains and the *.dl.wel1.ru DNS domain to limit potential communication with the malicious infrastructure.