MAL-2026-12707
Dashboard / Malicious Package / MAL-2026-12707
MAL-2026-12707
Summary: Malicious code in devplatform-create-nx-spa (npm)
Details: Source: amazon-inspector (6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464) [email protected] ships an `index.js` main entry that silently `require()`s `_bridge.js`, which on load assembles Cloudflare Workers hostnames (`oob-worker.cf10{0,1,2,3}-*.workers.dev`) and a fallback DNS-TXT channel to `*.dl.wel1.ru` from split-string arrays joined at runtime, downloads an unsigned opaque binary, writes it to `/var/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows, `chmod 0755`s it, and spawns it detached via `spawn('/bin/sh', ['-c', <path>+' &'], {detached:true})` or `spawn('cmd',...)`. The behavior is disguised as "analytics" and gated by an `/tmp/.analytics_state` timestamp. The `child_process` identifier and destination hostnames are assembled from 3-4 substring pieces (`['oob-worker.cf103-070.wor','ke','rs.dev'].join('')`, `require('child_'+'process')`) to defeat static string matching. The package presents itself as a lightweight Nx SPA scaffolder, but its main module's only load-time effect is to fetch and execute attacker-controlled code on the installer's host.
Affected packages
Package
Name: devplatform-create-nx-spa
Purl: pkg:npm/devplatform-create-nx-spa
Affected ranges
Type: N/A
Events:
