MAL-2026-12673
Dashboard / Malicious Package / MAL-2026-12673
MAL-2026-12673
Summary: Malicious code in ded-ps-ded-ps-core (npm)
Details: Source: amazon-inspector (cfe3941502d9792a1ad46ba7ed447227ef74d1c45cce8e9996005218d47f0f51) On require(), index.js loads _init.js, which selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts whose names are assembled at runtime by joining split string fragments (e.g. oob-worker.cf1-01-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT covert-channel fallback to base64-chunked subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written to /tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows — filenames chosen to mimic hidden cache and.NET diagnostics artifacts — then chmod 0755 and spawned detached via /bin/sh -c or cmd.exe start /b. lib/telemetry.js additionally constructs sensitive API names at runtime (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. Requiring the package causes arbitrary attacker-controlled native code to execute on the installer's host.
Affected packages
Package
Name: ded-ps-ded-ps-core
Purl: pkg:npm/ded-ps-ded-ps-core
Affected ranges
Type: N/A
Events:
