The devplatform-spa-plugin-devtools npm package version 35.5.6 includes malicious code in its _support.js file. When the package is required, it runs an init() routine that constructs destination hostnames from split string fragments and fetches an unsigned binary payload either via HTTPS or by concatenating base64 fragments from DNS TXT records. The payload is saved to disguised executable files in temporary directories and executed detached from the main process without any hash or signature verification. The code includes evasion mechanisms to avoid execution in developer, CI, or analyst environments by checking environment variables and npm lifecycle events. The use of DNS TXT records and host-string splitting are deliberate obfuscation techniques to evade detection by static analysis tools.

This malicious behavior allows arbitrary unsigned binary code to be downloaded and executed on the host system, potentially leading to full system compromise, unauthorized access, data theft, or further malware deployment. The evasion techniques reduce the likelihood of detection during development or automated analysis, increasing the risk of persistent undetected infection in environments using this package version.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove devplatform-spa-plugin-devtools version 35.5.6 from their environments and avoid installing or requiring this package. Verify the integrity and provenance of npm packages before use. Monitor for any suspicious processes or files matching the described patterns (e.g., dotnet_diag_<hex>.exe or .cache_<hex> in temporary directories). Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.