The devplatform-spa-plugin-s3 npm package at version 35.5.9 includes a malicious binary dropper. Its index.js requires a shim module that downloads a binary from multiple suspicious worker.dev domains, writes it to temporary filesystem locations with disguised filenames, sets executable permissions, and spawns it detached from the parent process. Additionally, a fallback covert channel reconstructs the payload from base64-encoded DNS TXT records under the dl.wel1.ru domain. The package uses obfuscation such as split-string requires and computed method names to evade static analysis. The payload is unverified and unrelated to any legitimate S3 or SPA plugin publisher. This malicious behavior activates immediately upon requiring the package.

This malicious package enables remote code execution on any system that installs and requires devplatform-spa-plugin-s3 version 35.5.9. The attacker can execute arbitrary binaries downloaded from attacker-controlled infrastructure, potentially leading to full system compromise. The use of obfuscation and covert DNS channels complicates detection and forensic analysis. There is no indication of a legitimate fix or patch, and the package is effectively a supply chain threat.

No official patch or remediation is indicated. Users should immediately remove devplatform-spa-plugin-s3 version 35.5.9 from their projects and dependency trees. Avoid installing or requiring this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected binaries or processes spawned from temporary directories. Consider scanning existing environments for presence of this package and any related dropped binaries. Report the package to npm security teams for takedown and further investigation.