The devplatform-ui-kit package version 35.6.2 is a malicious npm package that, upon being required or imported, dynamically constructs obfuscated hostnames to fetch a platform-specific binary from remote servers. It uses a DNS-TXT covert channel fallback to reassemble base64-encoded chunks from subdomains under dl.wel1.ru. The fetched binary is saved to temporary directories with disguised names (e.g., dotnet_diag_*.exe) and executed with elevated permissions (chmod 0755 on POSIX). Execution is detached from the parent process, allowing stealthy attacker-controlled code execution on the host system. No integrity checks such as hash or signature verification are performed on the downloaded binary.

This malicious package allows arbitrary code execution on any machine that installs or imports it, potentially leading to full compromise of the installer's environment. Because the payload is fetched dynamically and executed without verification, it can deliver any attacker-chosen payload, posing a critical security risk.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing devplatform-ui-kit version 35.6.2. Remove any existing installations of this package from development and build environments. Monitor for any unexpected network connections to obfuscated hosts such as *.workers.dev or dl.wel1.ru subdomains. Consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.