The devplatform-spa-plugin-module package version 35.7.9 includes a malicious _polyfill.js script that, when required, executes an init() function. This function reconstructs destination hostnames from split strings to select platform-specific endpoints hosted on Cloudflare Workers subdomains. It downloads an opaque binary payload via HTTPS, writes it to a disguised file in the system's temporary directory, sets executable permissions, and spawns it detached from the main process. If HTTPS retrieval fails, it falls back to resolving DNS TXT records from a specified discovery domain, concatenates base64-encoded chunks to reconstruct the payload, and executes it similarly. This fully productionized dropper delivers arbitrary attacker code during package installation or usage.

This malicious package enables arbitrary code execution on any system that installs or requires version 35.7.9 of devplatform-spa-plugin-module. The attacker can deliver and run any payload with the privileges of the user running the package, potentially compromising the host system. The use of disguised filenames, staging in temporary directories, detached execution, and a DNS TXT record fallback channel increases stealth and persistence capabilities.

No official patch or remediation is currently documented for this malicious package version. Users should immediately avoid installing or requiring devplatform-spa-plugin-module version 35.7.9. Remove any installations of this version from systems and audit for any suspicious processes or files in temporary directories. Use trusted sources and verify package integrity before installation. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.