The devplatform-sre-devplatform-sre-core npm package version 35.1.8 includes malicious functionality triggered upon require(). It loads a helper script that dynamically reconstructs hostnames to evade static detection and downloads a native binary from Cloudflare Workers domains. The binary is saved to temporary directories under deceptive names, permissioned to execute, and launched detached from the parent process. If HTTPS delivery is blocked, a DNS-TXT covert channel reassembles the payload from base64-encoded TXT records under the dl.wel1.ru domain. This mechanism grants full remote code execution to an attacker controlling these endpoints on any system using this package.

An attacker controlling the delivery endpoints can achieve full remote code execution on any machine that installs or imports the affected package version. This enables arbitrary code execution with the privileges of the running process, potentially leading to system compromise, data theft, or further malicious activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal of the malicious package is confirmed, avoid installing or importing devplatform-sre-devplatform-sre-core version 35.1.8. Consider using trusted package sources and verifying package integrity before use.