The devplatform-spa-cli package version 35.9.2 includes embedded malicious code in its index.js and lib/telemetry.js files. Upon module load, it asynchronously fetches a platform-specific binary payload from runtime-assembled Cloudflare Workers subdomains (e.g., oob-worker.cf100-*.workers.dev) with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru. The payload is saved under /var/tmp or %TEMP% with misleading filenames (.cache_<hex> on POSIX systems, dotnet_diag_<hex>.exe on Windows), permissions are set to executable (chmod 0755), and the payload is executed detached via shell commands (/bin/sh or cmd.exe). The destination hostnames and child_process require calls are constructed dynamically via array-join string concatenation to evade static analysis. No hash or signature verification is performed on the downloaded payload, and execution happens automatically when the package is imported. This represents a supply chain compromise with automatic remote code execution capability.

This malicious package enables automatic execution of arbitrary binaries fetched from attacker-controlled infrastructure without user consent or verification. This can lead to full system compromise, data theft, persistence, or further malware deployment on affected systems that install or require this package version. The obfuscation and automatic execution increase the risk of unnoticed compromise in development or production environments using this npm package.

No official patch or remediation is currently documented. Users should immediately avoid using devplatform-spa-cli version 35.9.2 and remove it from their environments. Verify the integrity of dependencies and consider using package integrity verification tools or trusted package registries. Monitor for updates or advisories from the package maintainers or npm registry regarding this incident. Since no patch is confirmed, exercise caution and consider blocking this package version in dependency management policies.