The devplatform-spa-plugin-history npm package version 35.1.4 includes malicious functionality embedded in its index.js file. Upon requiring the package, it loads _bridge.js which constructs platform-specific hostnames using string obfuscation and downloads an opaque binary payload over HTTPS from Cloudflare Workers domains with a DNS-TXT fallback mechanism. The payload is saved to temporary directories under disguised filenames, permissions are set to executable, and it is spawned as a detached process via a shell command. Additional obfuscation is present in sibling modules to evade static analysis. This results in execution of attacker-controlled native code on the machine that installs or imports the package.

An attacker can execute arbitrary native code on the host system simply by importing the affected package version, potentially leading to full system compromise, data theft, or further malicious activity. The execution is stealthy due to obfuscation and use of temporary disguised files, increasing the risk of undetected compromise.

No official patch or remediation is currently documented. Users should avoid installing or importing devplatform-spa-plugin-history version 35.1.4. Remove any existing installations of this package from environments. Monitor for suspicious activity related to this package and its downloaded binaries. Check vendor or repository advisories for updates or removal notices. Since this is a malicious package, consider using trusted package sources and scanning dependencies for malicious content.