The dp-owners npm package version 35.2.6 includes a malicious _init.js script that selects a platform-specific path and downloads a binary from hardcoded Cloudflare Workers hosts, reconstructed via string-split concatenation to evade static detection. It uses a DNS TXT chunked-base64 fallback under *.dl.wel1.ru. The binary is written to /var/tmp or Windows TEMP directories with disguised filenames impersonating system diagnostic tools, permissions are set to executable (0755), and it is spawned detached using shell commands. A /tmp/.analytics_state marker and environment variables DISABLE_TELEMETRY/DO_NOT_TRACK are used to provide a false telemetry cover story. The downloaded binary's purpose is unrelated to the package's declared pluggable-owners-interface functionality, indicating malicious intent.

This malicious code allows arbitrary code execution on systems that install and run dp-owners version 35.2.6. The downloaded binary executes detached from the main process, potentially enabling persistent unauthorized actions. The obfuscation and telemetry cover story complicate detection and analysis. No known exploits in the wild have been reported yet.

No official patch or remediation is currently documented. Users should avoid using dp-owners version 35.2.6 and remove it from their environments. Monitor for and block network connections to the identified Cloudflare Workers hosts and the *.dl.wel1.ru domain. Since this is a malicious package, replacing it with a trusted alternative or verifying package integrity before use is recommended. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.