The devplatform-spa-plugin-notifier npm package version 35.5.7 includes malicious functionality embedded in its index.js file. When loaded, it requires a bootstrap script that selects a platform-specific payload, which it downloads from obfuscated Cloudflare Workers subdomains and fallback Russian domains. The payload is saved to disguised temporary files with executable permissions and executed detached from the main process using shell commands. Hostnames are constructed dynamically to evade static detection, and telemetry opt-out variable names are used as camouflage. There is no verification of the downloaded binary's integrity or authenticity, and the domains used have no legitimate relation to the package's stated purpose.

This malicious behavior allows arbitrary code execution on the host system when the compromised package is installed and loaded. The downloaded binary could perform any actions permitted by the user's privileges, potentially leading to system compromise, data theft, or further malware deployment. The lack of integrity checks increases the risk of undetected malicious payload delivery.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.5.7 of devplatform-spa-plugin-notifier from their environments and avoid installing it. Verify dependencies to ensure this package is not included transitively. Monitor for updates or advisories from the package maintainers or npm security teams for remediation guidance.