The dp-web-header npm package (version 35.3.8) is a malicious package that, when installed or imported, unconditionally requires a module (_ext.js) that downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts. If the HTTPS fetch fails, it falls back to a DNS-TXT covert channel to reconstruct the binary from base64-encoded DNS labels under several attacker-controlled domains. The binary is saved to temporary directories with filenames impersonating legitimate diagnostic tools and executed detached via shell commands. The package writes a marker file and includes a misleading comment about SHA-256 integrity verification, which is not implemented. This behavior leads to execution of attacker-controlled native code on the host system.

Installation or import of dp-web-header version 35.3.8 results in execution of attacker-controlled native code on the host system. This can lead to full compromise of the affected system, including unauthorized access, data theft, or further malware deployment. The malicious binary is delivered stealthily via HTTPS or DNS covert channels, evading simple detection. The lack of integrity checks increases risk of undetected tampering or substitution of the payload.

No official patch or remediation is currently documented for this malicious package version. The best mitigation is to avoid installing or using dp-web-header version 35.3.8. Remove any existing installations of this package from your environment. Monitor for and block network connections to the identified Cloudflare Workers hosts and the specified DNS domains used for covert channel delivery. Employ supply chain security measures such as verifying package provenance and using trusted package registries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.