The dws-frontend-dws-frontend-core npm package version 35.4.3 includes code that, upon require(), loads a support script which downloads a platform-specific binary over HTTPS from external author-controlled domains (oob-worker.cf1*.workers.dev and a DNS TXT-record fallback under c.*.dl.wel1.ru). The downloaded binary is saved to temporary locations with filenames disguised as dotfile caches or Microsoft.NET diagnostic binaries, given executable permissions, and executed detached via shell commands. The code uses a marker file to throttle repeated execution and falsely signals respect for telemetry opt-out environment variables, while actually performing unauthorized remote binary execution. No hash or signature verification is performed on the downloaded payload, and the destination hosts are not publisher-owned or registry-hosted, indicating a supply chain compromise or malicious package.

This malicious package can execute arbitrary code on the host system by downloading and running a binary from attacker-controlled servers without integrity checks. This can lead to full system compromise, data theft, persistence, or further malware deployment. The disguised filenames and evasion techniques increase the difficulty of detection and removal.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.4.3) of dws-frontend-dws-frontend-core from their environments. Avoid installing or using this package version and monitor for any unauthorized binaries or suspicious processes spawned from temporary directories. Verify package integrity and source before installation. Check vendor advisories or npm security notices for updates or official fixes.