The 'devplatform-stylelint-config' npm package (version 35.7.4) includes a malicious payload embedded in its setup.js file, which is executed when the library loads. This setup script constructs obfuscated hostnames to download a platform-specific binary via HTTPS, stores it in a hidden temporary directory, modifies its permissions to be executable, and launches it detached from the main process. The binary download and execution occur without any hash or signature verification, increasing the risk of arbitrary code execution. The package's description and naming are deceptive, masking the malicious activity under the guise of an 'environment config reader' and 'analytics_state' telemetry gate.

This malicious package can lead to arbitrary code execution on the host system where it is installed. The downloaded binary runs with the permissions of the user executing the package, potentially enabling unauthorized actions, persistence, or further compromise. The lack of integrity checks on the downloaded binary increases the risk of executing tampered or malicious payloads.

Users should immediately remove the 'devplatform-stylelint-config' package version 35.7.4 from their environments. Avoid installing or using this package until a trusted, verified version is available. Since no patch or fix is currently indicated, users should verify the integrity and source of any dependencies. Monitor for any unexpected binaries or processes spawned from npm packages. Consider using package integrity verification tools and restrict execution of untrusted binaries.