The devplatform-spa-plugin-thermostat npm package version 35.9.9 includes code in index.js that loads a compatibility script selecting a platform-specific payload path. This script downloads a binary over HTTPS from dynamically constructed Cloudflare Workers subdomains and a DNS-TXT base64-chunk fallback domain. The binary is written to temporary directories with obfuscated filenames, permissions are set to executable, and it is spawned detached via shell commands. The child_process module is required using string concatenation to evade detection. No integrity checks such as hash or signature verification are performed on the downloaded binary. The package falsely claims to be a thermostat SPA plugin, while the payload and infrastructure serve a malicious purpose.

This malicious package can execute arbitrary binary code on the host system without user consent or verification, potentially leading to full system compromise or further malicious activity. The lack of integrity verification increases the risk of executing tampered or additional malicious payloads. Since the package is published on npm, developers unknowingly including this version may introduce this threat into their environments.

Avoid using devplatform-spa-plugin-thermostat version 35.9.9. Remove this package from any affected systems and replace it with a trusted alternative. Since no official patch or remediation is indicated, users should verify their dependencies and avoid installing or updating to this version. Monitor for any unusual processes spawned from npm packages and validate package sources before installation.