The devplatform-spa-plugin-error-boundary npm package (version 35.4.6) includes a main index.js that unconditionally requires a module (_ext.js) which, at load time, fetches a platform-specific native binary from obfuscated Cloudflare Workers endpoints or a covert DNS TXT channel under *.dl.wel1.ru. The binary is base64-decoded, saved to a randomly named file in the temporary directory, given executable permissions, and executed detached from the main process. There is no version pinning or hash verification, and the package's legitimate functionality does not justify fetching or executing native code, indicating malicious intent and arbitrary code execution on the installer's host.

Loading this package results in arbitrary code execution on the host system where it is installed, allowing an attacker to run any native binary of their choosing. This compromises the security and integrity of the affected system and can lead to full system compromise or further malicious activity.

No official patch or remediation is currently available. Users should avoid installing or using devplatform-spa-plugin-error-boundary version 35.4.6. Remove the package from any environments where it is present. Monitor for updates from the package maintainer or npm security advisories for any future fixes or removals.