The devplatform-table npm package version 35.7.6 includes malicious functionality in its index.js file, which loads a platform-specific payload from obfuscated Cloudflare Workers domains and a DNS-TXT fallback domain. The payload is downloaded as an executable, saved to temporary directories with disguised names, permissioned to be executable, and then spawned detached via shell commands. Sensitive Node.js APIs such as 'child_process' and 'chmodSync' are dynamically reconstructed at runtime to avoid static analysis detection. The downloaded binary is unpinned and unverified, allowing whoever controls the remote hosts to execute arbitrary code on any system that installs or imports this package.

Any system that installs or imports devplatform-table version 35.7.6 is at risk of arbitrary code execution by a remote attacker controlling the malicious payload hosts. This can lead to full compromise of the affected machine, including execution of arbitrary commands and potential persistence. The malicious payload is delivered without verification, increasing the risk of undetected compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or importing devplatform-table version 35.7.6. Consider removing the package from existing environments and scanning for its presence. Monitor for updates from the package publisher or security advisories for remediation.