The devplatform-spa-plugin-module-loader package version 35.8.5 includes code in index.js that unconditionally loads _platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts and a DNS-TXT fallback mechanism. The binary is saved to system temporary directories (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), given executable permissions, and executed via detached child processes. Hostnames and API calls are assembled from split string fragments to evade detection. The dropped files mimic legitimate cache or diagnostic paths, and comments misleadingly reference integrity checks and rate limiting that are not implemented. An opt-out environment variable named DISABLE_TELEMETRY is present to frame the behavior as analytics, but this is a cover story. The Cloudflare Workers hosts are anonymous and unrelated to any legitimate publisher, indicating malicious intent.

This malicious package can execute arbitrary code on the host system by downloading and running binaries without user consent. This can lead to system compromise, unauthorized access, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the difficulty of detection and mitigation. Since the package is from the npm ecosystem, it poses a supply chain risk to any projects that include this specific version.

Users should immediately remove version 35.8.5 of devplatform-spa-plugin-module-loader from their projects and replace it with a clean, verified version if available. Since no patch or official fix is indicated, avoid using this package version. Conduct a thorough investigation of any systems where this package was installed to detect and remediate any dropped binaries or spawned processes. Monitor for suspicious activity related to the described file paths and network connections. Check vendor advisories or npm security advisories for updates or remediation guidance.