MAL-2026-12706
Dashboard / Malicious Package / MAL-2026-12706
MAL-2026-12706
Summary: Malicious code in devplatform-cra-template (npm)
Details: Source: amazon-inspector (23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940) On `require('devplatform-cra-template')`, index.js loads _bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one of three concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under names mimicking legitimate tooling (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Every network destination, the `child_process` require, and `chmodSync` are assembled from split-string arrays joined at runtime to defeat static analysis. A second, structurally identical dropper is shipped in lib/telemetry.js (~81 KB, disguised as an analytics SDK): base64-assembled bytes, chmod 755, `cp.spawn('/bin/sh', ['-c', filePath + ' &'],...)`; it is not reachable from index.js in this version but is present in the tarball. The package name resembles the legitimate `cra-template` family, consistent with a typosquat lure delivering remote code to any consumer that requires it.
Affected packages
Package
Name: devplatform-cra-template
Purl: pkg:npm/devplatform-cra-template
Affected ranges
Type: N/A
Events:
