The devplatform-spa-plugin-query package version 35.8.5 includes malicious code that, when loaded, triggers index.js to load _bootstrap.js. This script constructs a command-and-control (C2) hostname by splitting strings and selects a platform-specific payload path to fetch opaque binary data over HTTPS. The binary is saved to a temporary location with misleading filenames, permissions are set to executable on Unix systems, and the payload is launched detached via shell commands on both Unix and Windows. Additionally, a covert DNS-TXT record channel is implemented as a fallback communication method if HTTPS is blocked. No integrity checks such as hash or signature verification are performed on the downloaded payload, increasing the risk of executing arbitrary malicious code.

This malicious package enables remote code execution on any system that installs and requires version 35.8.5 of devplatform-spa-plugin-query. The attacker can deliver arbitrary payloads that run with the privileges of the executing process, potentially leading to full system compromise. The use of covert DNS-TXT channels for fallback communication increases stealth and persistence capabilities. Lack of payload verification further exacerbates the risk.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.8.5 of devplatform-spa-plugin-query from their projects and dependency trees. Avoid installing or requiring this package version. Monitor for any unexpected network connections to the described C2 domains and consider scanning systems for the presence of the malicious payload files described. Check vendor advisories or trusted security sources for updates or official fixes.