The dwsai-dwsai-core npm package version 35.8.4 includes malicious functionality where requiring the package causes index.js to load _adapter.js, which downloads a platform-specific binary from author-controlled Cloudflare Workers mirrors. The binary is saved to temporary directories with masquerading filenames and executed detached from the parent process. Hostnames for the mirrors are dynamically constructed at runtime to evade detection, and a DNS-TXT fallback channel is used to fetch base64-encoded payload chunks, bypassing HTTPS egress filtering. No integrity checks such as hash or signature verification are performed on the downloaded binary. Execution is gated behind environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a cache file, presented as opt-out telemetry, but the obfuscation and execution method indicate malicious intent rather than legitimate telemetry.

The malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to unauthorized code execution and system compromise. The use of obfuscated network communication and covert DNS channels complicates detection and blocking. The masquerading of the binary as a legitimate Microsoft diagnostic tool may mislead defenders and users. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Users should avoid using dwsai-dwsai-core version 35.8.4 and remove it from their environments. Monitor for updates from the package maintainers or npm advisories for any official fixes. Due to the lack of integrity verification and covert communication channels, consider blocking network access to the identified Cloudflare Workers mirrors and the DNS TXT record domain c.*.dl.wel1.ru if feasible. Validate dependencies and audit packages for suspicious behavior before use.