The devplatform-spa-errors package version 35.5.7 is malicious. Its index.js unconditionally loads a loader script that selects platform-specific payloads fetched from obfuscated Cloudflare Workers subdomains and a DNS-TXT fallback channel. The payload is a native binary written to a temporary file with a disguised name, permissions set to executable, and then executed detached via shell commands. The package includes obfuscation and a decoy telemetry module duplicating the dropper logic to evade review. This delivers attacker-controlled native code to the host on module load without any integrity checks.

This malicious package enables remote code execution on the host system where it is installed by silently downloading and executing arbitrary native binaries. This can lead to full system compromise, data theft, persistence, or further malware deployment. There is no integrity verification, increasing the risk of undetected compromise.

No official patch or remediation is currently documented. Users should immediately remove version 35.5.7 of devplatform-spa-errors from their environments and avoid installing this version. Use trusted package sources and verify package integrity before installation. Monitor for any unexpected processes or files matching the described behavior. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.