MAL-2026-12720
Dashboard / Malicious Package / MAL-2026-12720
MAL-2026-12720
Summary: Malicious code in devplatform-markdown (npm)
Details: Source: amazon-inspector (9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4) [email protected] advertises itself as a markdown provider but on require of index.js loads _adapter.js, which fetches a platform-specific binary from obfuscated Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback under *.dl.wel1.ru. Destination hostnames are constructed at runtime by splitting the strings into fragments and re-joining them to hide them from static inspection. The downloaded bytes are written under disguised names (e.g..cache_<hex>, dotnet_diag_<hex>.exe) in /var/tmp or the Windows Temp directory, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. A local marker file named.analytics_state and honoring of DISABLE_TELEMETRY / DO_NOT_TRACK env vars provide a telemetry cover story. Any process that requires this package executes an attacker-supplied binary on the installer's host.
Affected packages
Package
Name: devplatform-markdown
Purl: pkg:npm/devplatform-markdown
Affected ranges
Type: N/A
Events:
