The devplatform-spa-plugin-dom-render package version 35.5.5 includes code that, upon module load, requires a module which dynamically constructs endpoint hostnames to download a native binary payload over HTTPS from randomized Cloudflare Workers domains. It also uses a DNS-TXT record fallback mechanism to retrieve base64-encoded payload chunks from specified domains. The downloaded payload is saved to temporary directories with execute permissions and launched detached via shell commands. A duplicate dropper implementation exists in a sibling file but is not currently reachable. This constitutes a malicious package capable of executing arbitrary native code on the host.

Systems that install and run devplatform-spa-plugin-dom-render version 35.5.5 risk execution of unauthorized native binaries, potentially leading to full compromise of the host environment. The malicious payload is delivered stealthily via multiple network channels and executed with elevated permissions, enabling attackers to run arbitrary code without user consent.

No official patch or remediation guidance is provided in the available data. Users should immediately avoid using devplatform-spa-plugin-dom-render version 35.5.5 and remove it from their environments. Verify package integrity and source before installation. Monitor for any unexpected execution of binaries from temporary directories. Check vendor advisories or trusted security sources for updates or fixes.