The devplatform-spa-route-tree npm package (version 35.1.3) includes a require() call that loads a loader script (_loader.js) which constructs hostnames at runtime to download a platform-specific binary from Cloudflare Workers subdomains and a fallback DNS-TXT chunked domain under *.dl.wel1.ru. The binary is saved to temporary locations on Unix or Windows systems, given executable permissions, and executed detached from the main process. The binary masquerades as .NET diagnostic tooling but is opaque, unpinned, and unverified, raising significant concerns about malicious intent. The hostname assembly and environment variable checks are used to evade static detection and provide cover framing. This behavior constitutes a malicious package rather than a traditional vulnerability.

This malicious package can execute arbitrary code on affected systems by downloading and running an unverified binary, potentially leading to full system compromise, data theft, or persistence. The use of obfuscated hostnames and detached execution complicates detection and response. Because the binary is served from non-publisher infrastructure and is opaque, the exact payload and impact are unknown but potentially severe.

No official patch or remediation is currently documented. Users should immediately cease using devplatform-spa-route-tree version 35.1.3 and remove it from their environments. Avoid installing or running this package until a trusted, verified version is available. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Monitor for any unusual execution of binaries masquerading as .NET diagnostic tools in temporary directories.