The devplatform-spa-plugin-s3-feature-toggle npm package (version 35.7.1) includes malicious code that triggers on require(). It loads a runtime script which selects a platform-specific endpoint and downloads a binary over HTTPS from obfuscated Cloudflare Workers subdomains. The binary is saved to a temporary directory with hidden filenames and executed with elevated permissions. If HTTPS delivery fails, the package falls back to retrieving the binary via DNS TXT record queries from attacker-controlled domains, reconstructing the payload from base64-encoded chunks. No hash or signature verification is performed on the downloaded binary, which is opaque and delivered from anonymous infrastructure. This behavior results in full remote code execution on the host machine during package installation or import.

This malicious package enables an attacker to execute arbitrary native code remotely on the host system during npm install or require(), potentially leading to complete system compromise. The use of obfuscated domains and a DNS-based fallback channel complicates detection and blocking. The lack of binary verification increases the risk of executing arbitrary payloads controlled by the attacker.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring devplatform-spa-plugin-s3-feature-toggle version 35.7.1. Remove the package from any affected environments and audit systems for signs of compromise. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removal actions. Employ network controls to block connections to the identified malicious domains if possible.