The devplatform-spa-plugin-auth npm package version 35.4.5 includes a main entry script that automatically invokes a start() routine on require. This routine dynamically constructs hostnames and retrieves a native binary payload from Cloudflare Workers domains or fallback DNS TXT records hosted on suspicious domains. The binary is saved to a temporary location on the host filesystem, permissioned for execution, and launched detached via system shell commands. The package suppresses repeated execution via a marker file and silences error output. Since the package is advertised as an SPA auth-token plugin, this behavior is unauthorized and malicious, enabling full arbitrary code execution controlled by the attacker operating the remote infrastructure.

Any system that installs and requires devplatform-spa-plugin-auth version 35.4.5 is at risk of silent remote code execution. The attacker-controlled native binary can execute arbitrary commands with the privileges of the user running the Node.js process, potentially leading to full system compromise. The malicious code fetch mechanism and execution are stealthy, with suppressed error output and a marker file to avoid repeated runs, increasing the likelihood of persistent undetected compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is available, users should avoid installing or using devplatform-spa-plugin-auth version 35.4.5. If already installed, remove the package and any related artifacts immediately. Monitor for suspicious processes or files matching the described behavior. Consider using package integrity verification and supply chain security tools to detect malicious dependencies.