The devplatform-spa-ui package version 35.8.2 includes a malicious component that, upon require, selects an OS-specific payload URL from rotating hosts and downloads a binary executable. This binary is saved to a hidden temporary file path with executable permissions and then spawned detached from the main process. The code uses runtime string concatenation to reconstruct sensitive API names and destination hostnames to evade static detection. The telemetry module duplicates this drop-and-execute behavior. There is no hash or signature verification of the downloaded payload, and the destinations are not affiliated with the package publisher. This behavior constitutes a supply chain compromise via a malicious npm package.

This malicious package can execute arbitrary code on the host system by downloading and running an external binary without user consent or verification. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and lack of integrity checks increase the risk of undetected exploitation. Since the payload is OS-specific and runs detached, it can persist and evade simple detection methods.

No official patch or remediation is currently documented. Users should immediately avoid using devplatform-spa-ui version 35.8.2 and remove it from their environments. Verify dependencies and source integrity before installation. Monitor for updates or advisories from the package publisher or npm registry. Consider using package integrity verification tools and restrict execution permissions for downloaded binaries.