MAL-2026-12725

Dashboard / Malicious Package / MAL-2026-12725

MAL-2026-12725

Summary: Malicious code in devplatform-nx-pvm (npm)

Details: Source: amazon-inspector (58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4) On require() of devplatform-nx-pvm, _compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a disguised filename (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. The C2 hostnames are assembled from split string arrays (e.g. ["oob-worker.cf100-416.work","ers.dev"].join("")) to evade static scanners, and a cover file named analytics_state is used as a run marker. If the HTTPS fetches fail, the code falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru, retrieving a chunk count from c.<domain> and base64-encoded payload chunks from N.<domain>, concatenating and decoding them, then executing the resulting binary. The dropper is skipped when specific telemetry opt-out environment variables are set, further indicating stealth. The package presents itself as a trivial library shim, and index.js unconditionally requires _compat, so installing and importing the package auto-executes the attacker-controlled binary on the installer's machine.

References: https://www.npmjs.com/package/devplatform-nx-pvm/v/35.2.9