The devplatform-spa-plugin-beaver package (version 35.2.2) includes malicious code in its _init.js file that, upon require(), dynamically constructs Cloudflare Workers hostnames to download an unsigned binary payload. This payload is stored in temporary directories with system-like filenames and executed detached from the parent process to persist beyond the require call. Additionally, a DNS-TXT record covert channel over specific subdomains provides a fallback method for payload delivery, circumventing HTTP egress filtering. The execution is gated by environment variables that opt out of telemetry and analytics, and a time-to-live marker ensures the payload executes only once per fresh host to reduce detection. The payload's source domains and behavior are inconsistent with legitimate npm package operations, indicating malicious intent.

The malicious payload execution can lead to unauthorized code execution on affected systems, potentially allowing attackers to run arbitrary binaries outside the npm ecosystem. The use of covert DNS channels and obfuscated download URLs complicates detection and network filtering. The payload runs with the privileges of the executing user and persists beyond the initial package require call, increasing the risk of stealthy compromise. There is no indication of direct data exfiltration or further payload capabilities from the provided data, but the capability to execute arbitrary code poses a significant security risk.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.2.2 of devplatform-spa-plugin-beaver from their environments and avoid installing it. Employ strict package source verification and integrity checks to prevent installation of malicious packages. Monitor for presence of unexpected binaries in temporary directories and suspicious DNS TXT queries to the indicated domains. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.