The devplatform-spa-plugin-location package (version 35.9.2) includes a malicious _vendor.js script that dynamically constructs URLs to Cloudflare Worker hosts and fallback domains to download binary payloads. These payloads are written to temporary directories with disguised names, permissions set to executable, and launched in a detached manner using shell commands. The code suppresses console output and uses runtime string joining to evade static detection. This behavior effectively turns the package into a remote code execution dropper, compromising any host that imports it.

Any system that installs and imports devplatform-spa-plugin-location version 35.9.2 is at risk of arbitrary remote code execution. The malicious payload can execute with the privileges of the importing process, potentially leading to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately remove and avoid using devplatform-spa-plugin-location version 35.9.2. Verify that no unauthorized binaries have been executed from temporary directories. Monitor for suspicious processes spawned from npm modules. Check vendor advisories or trusted security sources for updates or fixes.