The devplatform-vite-plugin-preserve-css-modules npm package (version 35.6.8) includes malicious functionality triggered on require(). It loads a loader script that dynamically constructs obfuscated hostnames to download a native binary over HTTPS, with a DNS TXT record fallback mechanism for covert communication. The binary is saved to temporary directories with disguised names, permissions are set to executable, and it is spawned detached via shell commands. Execution is controlled by a TTL marker file. This behavior enables arbitrary native code execution on the host machine without user consent. The package name is crafted to appear as a legitimate vite plugin, facilitating supply chain compromise through npm.

This malicious package enables arbitrary native code execution on any system that installs and requires version 35.6.8 of devplatform-vite-plugin-preserve-css-modules. The attacker can execute arbitrary binaries downloaded from attacker-controlled infrastructure, potentially leading to full system compromise. The covert DNS TXT fallback and obfuscated hostnames increase stealth and complicate detection. There is no indication of active exploitation in the wild yet, but the risk of supply chain compromise is significant.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring devplatform-vite-plugin-preserve-css-modules version 35.6.8. Remove any installations of this package from projects and dependency trees. Monitor for any unexpected network connections to the described domains and for suspicious binaries in temporary directories. Consider using npm security tools to audit dependencies and block malicious packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.