The malicious devplatform-vite-plugin-gle package, specifically version 35.3.9, contains code that dynamically constructs command-and-control (C2) hostnames and downloads a binary payload via HTTPS with a DNS TXT record fallback. The payload is saved to a temporary file location on the host system, given executable permissions, and executed in a detached shell process. The loader uses a lock file to throttle repeated execution and includes misleading comments suggesting it is an analytics tool. No cryptographic verification of the downloaded binary is performed, increasing risk of arbitrary code execution. The package name is designed to resemble a legitimate Vite plugin, facilitating supply chain compromise.

This malicious package allows remote attackers to execute arbitrary code on affected systems by downloading and running an unverified binary payload. This can lead to system compromise, persistence, and potentially further malicious activity. The lack of integrity checks on the payload increases the risk of executing malicious code. The masquerading as an analytics tool may delay detection.

No official patch or remediation is currently documented. Users should immediately remove the devplatform-vite-plugin-gle package version 35.3.9 from their environments and avoid installing packages from untrusted sources. Verify package authenticity before installation and monitor for suspicious network activity related to the described C2 domains. Check vendor advisories or trusted security sources for updates or fixes.