MAL-2026-12692
Dashboard / Malicious Package / MAL-2026-12692
MAL-2026-12692
Summary: Malicious code in devplatform-api-endpoint (npm)
Details: Source: amazon-inspector (4a79a64efe72b14455f83f667581664c2369f92f669983a58cede299f70bcadc) On require() of the package's main entry, index.js unconditionally loads _bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers hosts whose names are constructed by concatenating fragmented string literals (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The downloaded bytes are written to a temp path with a masquerading filename (dotnet_diag_*.exe,.cache_*), chmod 0755'd, and spawned detached via child_process (/bin/sh -c or cmd.exe /c start). A DNS-TXT covert-channel fallback resolves TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) enumerated as c.<domain>, 0.<domain>, 1.<domain>,... and base64-decodes the concatenated TXT payloads into an executable that is then written and run. Endpoint literals are fragmented (e.g., ["oob-worker.cf101-","ad","f.workers.d","ev"].join("")) purely to evade static matching. The package advertises no purpose that justifies fetching and executing remote binaries.
Affected packages
Package
Name: devplatform-api-endpoint
Purl: pkg:npm/devplatform-api-endpoint
Affected ranges
Type: N/A
Events:
