The devplatform-ui-notification package version 35.3.6 includes code that unconditionally requires a compatibility module which downloads a platform-specific executable payload over HTTPS from obfuscated Cloudflare Workers domains and a DNS-TXT fallback channel. The payload is saved to /var/tmp or Windows TEMP directories under disguised names, made executable, and spawned detached via shell commands. The code uses string concatenation to evade static scanning of URLs and APIs, and duplicates this download-and-execute logic in a telemetry module. There is no version pinning or cryptographic verification of the downloaded payload, indicating a supply chain compromise or malicious package insertion.

An attacker controlling the remote payload servers can execute arbitrary code on any system that installs and runs devplatform-ui-notification version 35.3.6. This can lead to full system compromise, persistence, data theft, or further malware deployment. The lack of payload verification and obfuscation techniques increase the risk and difficulty of detection.

No official patch or remediation is currently documented. Users should immediately stop using devplatform-ui-notification version 35.3.6 and remove it from their environments. Verify the integrity and provenance of npm packages before installation. Monitor for updates or advisories from the package maintainers or npm security teams. Consider using package integrity verification tools and supply chain security measures to prevent similar incidents.