The devplatform-spa-plugin-sentry package version 35.1.1 includes code that, upon require, loads a helper script which fetches a native binary tailored to the operating system and architecture from obfuscated Cloudflare Workers subdomains. It also uses a DNS-TXT covert channel fallback from specific domains to reconstruct a base64-encoded payload. The binary is saved to temporary directories with hidden or system-tool-impersonating filenames, permissioned to be executable, and then launched detached via shell commands. The destination hostnames and filenames are dynamically assembled at runtime to evade static detection. This behavior is inconsistent with legitimate Sentry SPA plugin functionality and indicates malicious intent.

This malicious package can execute arbitrary native code on the host system, potentially leading to full system compromise, persistence, data exfiltration, or further malware deployment. The use of obfuscated network infrastructure and covert channels complicates detection and analysis.

No official patch or remediation is currently documented. Users should immediately remove version 35.1.1 of devplatform-spa-plugin-sentry from their environments and avoid installing this package. Monitor for any unexpected network activity related to the described domains and binaries. Verify dependencies and use trusted sources for npm packages.