The devplatform-spa-feature-toggle npm package version 35.8.4 includes malicious code that, when required, loads a bridge script selecting an OS-specific payload path. It fetches an executable payload from a set of Cloudflare Workers hosts constructed dynamically at runtime, with fallback to other suspicious domains via DNS-TXT chunked-base64. The payload is written to temporary directories under decoy names, permissions are set to executable, and it is spawned detached with ignored stdio. The package attempts to evade telemetry and tracking via environment variables and marker files. The fetched payload is opaque and executed without any integrity checks. The destination hosts are unrelated to the package publisher, indicating a malicious supply chain compromise.

This malicious package can execute arbitrary code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The opaque payload and lack of integrity verification increase risk as the payload could change or be updated by the attacker. The use of decoy filenames and telemetry evasion techniques complicate detection and forensic analysis.

No official patch or remediation is currently documented. Users should immediately remove version 35.8.4 of devplatform-spa-feature-toggle from their environments. Avoid using this package version and verify package integrity before installation. Monitor for updates or advisories from the package maintainers or npm registry. Consider scanning existing systems for presence of the malicious payload files and related artifacts.