If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9)
devplatform-eslint-config@35.8.9 ships no ESLint configuration despite its name and description. Requiring the package loads _compat.js, which on import selects a payload path based on OS/architecture (linux_x64, linux_arm64, darwin, win32), fetches an opaque native binary over HTTPS from a rotating set of Cloudflare Workers hosts whose names are assembled at runtime by joining split string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT covert-channel fallback that reassembles base64 chunks from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a temporary path with a decoy filename (e.g. dotnet_diag_*.exe,.cache_*), chmod 0755, and executed via a detached child process (cp.spawn('/bin/sh',['-c', fp+' &'], {detached:true}) on POSIX, cmd.exe start /b on Windows). lib/telemetry.js contains duplicate fetch-write-chmod-spawn primitives. Runtime string assembly of C2 hostnames hides destinations from static analysis, and the ESLint-config identity is a cover story unrelated to the shipped code.