The devplatform-spa-plugin-ability npm package (version 35.5.2) is a malicious package that, upon being required, loads a bootstrap script which downloads a native binary tailored to the platform from anonymous Cloudflare Workers domains assembled at runtime. It uses a DNS-TXT covert channel fallback to retrieve the binary shards, which are base64-decoded and concatenated into an executable buffer. The binary is saved to disguised paths such as /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, given executable permissions (chmod 0755), and executed detached via shell commands without any hash or signature verification. The package includes decoy telemetry scripts and environment variable gates to provide a false cover story unrelated to its stated purpose as an SPA plugin SDK. This results in arbitrary code execution on the installer host.

Installing or requiring this package leads to execution of attacker-controlled native code on the host system, which can compromise the system's integrity, confidentiality, and availability. The malicious payload is delivered without any verification, increasing the risk of undetected compromise. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available. Users should avoid installing or requiring the devplatform-spa-plugin-ability package version 35.5.2. Verify package authenticity before use and prefer trusted sources. Monitor for updates from the package maintainer or npm advisory channels for remediation guidance.