MAL-2026-12717

    Dashboard / Malicious Package / MAL-2026-12717

    MAL-2026-12717

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devplatform-jscodeshift-plugin (npm)

    Details: Source: amazon-inspector (92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253) On require(), index.js loads _loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments (e.g. ['oob-worke','r.cf101-a','df.workers.d','ev'].join('')) and a DNS-TXT fallback channel via fragmented 'sdk.dl.wel1.ru' resolvers, downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0o755, and spawns it detached via cp.spawn('/bin/sh',['-c', fp+' &']) or spawn('cmd',...). The dropped artifacts use names impersonating telemetry / dotnet diagnostics, and environment variables like DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are honored to provide a cover story. The package has no jscodeshift-plugin functionality and appears to be a name-squat lure whose only purpose is dropping and executing this remote payload.

    References: https://www.npmjs.com/package/devplatform-jscodeshift-plugin/v/35.4.1

    Affected packages

    Package

    Name: devplatform-jscodeshift-plugin

    Purl: pkg:npm/devplatform-jscodeshift-plugin

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.4.1
    MAL-2026-12717 | CVE-DB