MAL-2026-12676

Dashboard / Malicious Package / MAL-2026-12676

MAL-2026-12676

Summary: Malicious code in delivery-ci-microforms (npm)

Details: Source: amazon-inspector (3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7) On require('delivery-ci-microforms'), index.js loads _support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime from split string arrays, fetches an opaque binary from oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev, or cf102-baf.workers.dev, or falls back to a chunked base64 payload carried in DNS TXT records under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under deceptive names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true, stdio:'ignore'}) or spawn('cmd',...) on Windows. lib/telemetry.js additionally reassembles the 'child_process' module name from a split string ('child_' + 'process') to defeat static inspection, and the drop path is gated behind opt-out env checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) with an 'analytics' cover-story naming scheme. Installing or requiring the package auto-executes attacker-controlled code from ephemeral Cloudflare Workers hosts on the installer's machine.

References: https://www.npmjs.com/package/delivery-ci-microforms/v/35.3.5