The devplatform-utils package at version 35.5.2 includes an index.js module that requires a _bootstrap.js script. This script downloads a binary payload from obfuscated Cloudflare Workers endpoints (e.g., oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback via *.dl.wel1.ru. The payload is stored in temporary directories (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), given execute permissions (chmod 0755), and executed detached via shell commands. Hostnames for the payload download are assembled at runtime using fragmented string arrays to evade static detection. A rate-limit token stored in /tmp/.analytics_state enforces a ~5.9-hour expiration, causing the binary to be re-fetched and re-executed on subsequent require() calls, thus maintaining persistence. The code checks environment variables DISABLE_TELEMETRY and DO_NOT_TRACK to mimic legitimate telemetry opt-out behavior. No hash or signature verification is performed on the downloaded binary, allowing arbitrary code execution controlled by the attacker.

This malicious package enables an attacker to remotely deliver and execute arbitrary binary code on the host system where [email protected] is installed. The persistence mechanism ensures repeated execution of the malicious payload, potentially leading to full system compromise or further malicious activity. The lack of integrity checks on the downloaded payload increases the risk of undetected compromise. Because the payload is executed detached and uses obfuscated network endpoints, detection and mitigation may be challenging.

No official patch or remediation is currently documented for [email protected]. Users should immediately remove or avoid using this package version. Investigate and clean any systems where this package was installed to detect and remove the malicious payloads. Monitor for suspicious processes spawned from temporary directories with names like dotnet_diag_* or .cache_*. Since no integrity verification is performed on the payload, do not trust binaries downloaded by this package. Check for updates or advisories from the package maintainers or npm registry for any forthcoming fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.