MAL-2026-12699

    Dashboard / Malicious Package / MAL-2026-12699

    MAL-2026-12699

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devplatform-cli (npm)

    Details: Source: amazon-inspector (626164264796294f1cb4322c03454ff5d9c50f7f0edb7534bfb6a5843d08079d) On require() of devplatform-cli, index.js loads _adapter.js which assembles Cloudflare Workers hostnames from string-split fragments (e.g. ["oob-worker.cf","103-070.workers.d","ev"].join("")) with a DNS-TXT chunked-base64 fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, downloads a platform-specific binary, writes it to /var/tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), calls fs.chmodSync(path, 0o755) on POSIX, and background-spawns it detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true,stdio:"ignore"}) or cmd /c start /b. A sibling module lib/telemetry.js (81KB, framed as "Analytics SDK") duplicates the same fetch->write->chmod 0755->spawn /bin/sh pattern and further obfuscates dangerous APIs via require("child_"+"process") and fs["chmod"+"Sync"]. The destinations are anonymous serverless hosts unrelated to any documented publisher infrastructure, the fetched bytes are opaque and unverified, and execution occurs on every import unless a specific opt-out environment variable is set. Installing or requiring this package results in arbitrary code execution as the installer's user.

    References: https://www.npmjs.com/package/devplatform-cli/v/35.7.4

    Affected packages

    Package

    Name: devplatform-cli

    Purl: pkg:npm/devplatform-cli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.4