The 'devplatform-spa-testing' npm package version 35.8.6 includes malicious functionality in its index.js file. When required, it loads a platform-specific script that constructs obfuscated C2 hostnames by joining string fragments to evade static detection. It then retrieves a payload over HTTPS or via a DNS-TXT fallback from these C2 servers. The payload is written to a temporary directory under disguised filenames ('.cache_<random>' on POSIX systems or 'dotnet_diag_<random>.exe' on Windows), permissions are set to executable, and the payload is spawned detached using shell commands. This results in execution of attacker-controlled code on the host machine at import time.

This malicious package leads to remote code execution on any system that imports it, allowing attackers to run arbitrary code with the privileges of the importing process. The obfuscation techniques and use of temporary disguised files make detection and analysis more difficult. There are no reports of known exploits in the wild yet.

No official patch or remediation is currently documented. Users should avoid installing or importing 'devplatform-spa-testing' version 35.8.6. Verify package integrity and source before use. Monitor for updates or advisories from the package maintainer or npm registry. Consider removing the package from projects and replacing it with trusted alternatives.