The devplatform-spa-plugin-i18next-instance package version 35.5.9 includes a malicious payload that triggers on require/import. It loads a setup.js script that downloads a binary from one of four hardcoded Cloudflare Workers domains or fallback DNS TXT records if HTTPS fails. The binary is saved to temporary directories with filenames resembling legitimate system files and executed with elevated permissions via child_process and chmodSync APIs. The code uses runtime string reconstruction to evade static analysis. No signature or hash verification is performed on the downloaded binary. The telemetry opt-out flag is present but does not block the malicious download or execution. The Cloudflare Workers hosts are unrelated to the legitimate plugin and serve as anonymous distribution points for the malware.

This malicious package can execute arbitrary code on the host system by downloading and running an unsigned binary from attacker-controlled infrastructure. This can lead to full system compromise, unauthorized access, and persistence. The disguised filenames and obfuscation techniques increase the likelihood of evading detection by security tools.

No official patch or remediation is currently documented. Users should immediately remove version 35.5.9 of devplatform-spa-plugin-i18next-instance from their environments and avoid installing this version. Monitor for any unexpected processes or files matching the described patterns. Use trusted sources and verify package integrity before installation. Check vendor or repository advisories for updates or fixes.