The devplatform-spa-plugin-feature-toggle npm package at version 35.7.4 includes embedded malicious functionality that triggers on import. It constructs obfuscated URLs to download OS-specific binaries from anonymous Cloudflare Workers domains and a DDNS host. These binaries are saved to temporary filesystem locations (/var/tmp/.cache_<rnd> on Unix, %TEMP%/dotnet_diag_<rnd>.exe on Windows), permissioned as executable, and launched detached via shell commands. The package's main entry loads a support script that builds these URLs using array-join concatenation to evade detection by string scanning. Additionally, a sibling telemetry.js file contains a larger variant of the drop-and-execute code, though it is not currently invoked. The payload is opaque with no integrity verification, increasing risk of arbitrary code execution on the host.

This malicious package enables remote attacker-controlled code execution on the host system during installation or import, potentially leading to full system compromise. The downloaded binaries run with the privileges of the user installing or importing the package. The lack of integrity checks on the payload allows arbitrary code to be executed without detection. The obfuscation and use of anonymous Cloudflare Workers and DDNS domains complicate attribution and detection.

No official patch or remediation is currently documented. Users should immediately avoid using devplatform-spa-plugin-feature-toggle version 35.7.4. Remove the package from all environments and replace it with a trusted alternative. Conduct a thorough investigation of any systems where this package was installed to detect and remediate potential compromise. Monitor for suspicious processes or files matching the described behavior. Check vendor advisories or trusted security sources for updates or fixes.