The 'devplatform-spa-testing' npm package (version 35.8.6) includes malicious functionality in its index.js file. Upon requiring the package, it loads a platform-specific script that constructs obfuscated C2 hostnames to retrieve a payload over HTTPS. This payload is saved to temporary directories under disguised filenames and executed detached via shell commands. The obfuscation techniques include string concatenation of hostname fragments and misleading comments to evade detection. The attacker-controlled payload execution at import time results in full compromise of the host machine.

Any system that installs or runs this package is considered fully compromised. The attacker gains the ability to execute arbitrary code with the privileges of the user running the package. This can lead to theft of secrets, keys, and other sensitive information. Because the malicious payload is executed immediately and may install persistent backdoors, simply removing the package does not ensure complete remediation.

Immediate removal of the 'devplatform-spa-testing' package version 35.8.6 is recommended. All secrets and keys stored on the compromised machine should be rotated from a separate, trusted device. Due to the high likelihood of persistent compromise, a full system reinstallation or forensic analysis is advised to ensure complete eradication of malicious software. No official patch or fix is available; users must avoid this package version entirely.