The [email protected] npm package masquerades as an analytics library but contains malicious code that triggers on require(). It loads a loader script (_adapter.js) that dynamically constructs obfuscated Cloudflare Workers URLs to download a platform-specific executable. This executable is saved to a temporary directory with a hidden filename, permissions are set to executable, and it is spawned detached via shell commands. Additionally, a DNS-TXT record covert channel under *.dl.wel1.ru is used as a fallback to deliver the binary in base64 chunks. No native source code or build steps exist in the package, and the downloaded binary is opaque and unrelated to the publisher. This results in arbitrary code execution on the host running the installer.

Successful installation or requiring of this package leads to arbitrary code execution on the host system with the privileges of the installer. The attacker-controlled binary is downloaded and executed without user consent, potentially compromising the entire system. This poses a critical security risk including possible system takeover, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing or requiring devplatform-spa-plugin-analytics version 35.5.7. Verify package authenticity before use and consider removing this package from existing environments. Monitor for suspicious activity related to this package and block network connections to the identified Cloudflare Workers domains and the *.dl.wel1.ru domain if possible.