Malicious code in devplatform-spa-plugin-remote-module (npm)

The npm package devplatform-spa-plugin-remote-module was found to contain malicious code that executes on package import. The index.js file loads support.js, which downloads platform-specific binaries from attacker-controlled Cloudflare Workers domains (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT record fallback mechanism that reassembles base64-encoded payloads from numbered subdomains under dl.wel1.ru.\n\nThe downloaded binary is written to temporary directories (/var/tmp on Unix or %TEMP% on Windows) under disguised filenames (.cache or dotnet_diag_.exe), made executable (chmod 0o755), and spawned as a detached process via shell commands (/bin/sh -c or cmd.exe /c start). A secondary module lib/telemetry.js contains identical dropper primitives with obfuscated require statements and filesystem operations.\n\nThe malicious code uses runtime string reconstruction (e.g., array-join fragments) to evade static analysis detection. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.\n\nAny system that installed and required this package would execute arbitrary attacker-controlled binaries with the privileges of the Node.js process.