The devplatform-snarkdown package version 35.2.1 is a malicious npm package that, upon being required, executes a platform-specific script (_shim.js) which downloads a native binary from hardcoded Cloudflare Workers domains or reconstructs it via a DNS-TXT covert channel from wel1.ru subdomains. The binary is saved to a temporary path with a disguised filename, permissions are set to executable, and it is spawned detached using shell commands. The package uses runtime assembly of hostnames to evade static analysis and employs a timestamped lockfile to limit re-execution frequency. It also checks for environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) to avoid running in sandbox or continuous integration environments, masquerading its behavior under a telemetry-related cover story. This malicious behavior is unrelated to the package's advertised function as a markdown parser.

The package executes arbitrary native code on the host system without user consent, which can lead to full system compromise depending on the payload. The use of covert channels and evasion techniques complicates detection and analysis. This poses a significant risk to any environment where this package version is installed and required.

No official patch or remediation is currently documented. Users should immediately avoid using devplatform-snarkdown version 35.2.1. Remove this package from all projects and replace it with a trusted alternative. Conduct a thorough investigation of any systems where this package was installed to detect potential compromise. Monitor for any unusual processes spawned by this package and network connections to the indicated Cloudflare Workers hosts or wel1.ru subdomains. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.