The devplatform-zod-wip-api package version 35.9.3 is a typosquatting malicious package targeting the zod ecosystem. Upon being required, it immediately executes code that reconstructs a command-and-control hostname from obfuscated string fragments and DNS TXT records, then downloads a native binary over HTTPS. This binary is saved to temporary OS-specific locations with disguised filenames, given executable permissions, and launched detached from the parent process. The package includes a marker file to limit re-execution frequency to about six hours. A secondary dropper in telemetry.js uses base64-encoded DNS TXT chunks to fetch and execute additional code. The use of obfuscation, masquerading filenames, and multiple execution paths indicates deliberate evasion and malicious intent. No signature or hash verification is performed on the downloaded binaries, allowing arbitrary native code execution on the host.

Any system that installs or requires [email protected] will execute arbitrary attacker-controlled native code with the privileges of the user running the Node.js process. This can lead to full system compromise, persistence, data exfiltration, or further malware deployment. The lack of integrity checks on downloaded binaries increases risk. The malicious code runs immediately on import, making all dependent projects vulnerable if they mistakenly include this package.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or requiring [email protected]. Users should verify package authenticity before installation, prefer official and well-known packages, and remove any instances of this package from their environments. Monitoring for and blocking network connections to the identified C2 domains may help detect or prevent payload retrieval. Since this is a malicious typosquat package, remediation involves removal and avoiding its use rather than patching.