The devplatform-spa-devtools package (version 35.2.6) includes code in index.js that loads _runtime.js, which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts. The hostnames are dynamically reconstructed at runtime from split string arrays. The downloaded payload is saved to disk under disguised names (e.g., dotnet_diag_<hex>.exe on Windows, .cache_<hex> on Unix), given executable permissions, and executed detached with no hash or signature verification. If this primary method fails, a fallback uses DNS TXT record lookups from *.dl.wel1.ru subdomains to reconstruct a base64-encoded binary via a covert DNS channel, bypassing HTTPS egress controls, and executes it similarly. Environment variables named after common telemetry opt-outs suppress repeated execution to provide a cover story. The malicious domains have no legitimate relation to the devplatform-spa-devtools package.

This malicious package version can execute arbitrary code on the host system by downloading and running unverified executables, potentially leading to full system compromise. The use of covert DNS channels and obfuscated hosts complicates detection and blocking. The execution suppression via environment variables may delay discovery. No known exploits in the wild are reported yet.

No official patch or remediation is currently documented. Users should avoid using devplatform-spa-devtools version 35.2.6. Verify package integrity before installation and consider removing this version from environments. Monitor for updates or advisories from the package maintainers or security vendors. Employ network controls to block suspicious domains and DNS queries related to the described infrastructure.