MAL-2026-12729

    Dashboard / Malicious Package / MAL-2026-12729

    MAL-2026-12729

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devplatform-nx-svelte (npm)

    Details: Source: amazon-inspector (19a9e164d3a912ce2cb11abb935eb46fdfa9bb7ef12acbe4a305867cb8942306) On require of the package, _compat.js constructs C2 hostnames by joining split string fragments to evade static inspection, downloads a platform-specific executable from Cloudflare Workers subdomains (oob-worker.cf1**-***.workers.dev), and falls back to a DNS-TXT covert channel that reassembles base64 chunks from TXT records at c.<subdomain>.dl.wel1.ru / N.<subdomain>.dl.wel1.ru across sdk/ext/pkg/net.dl.wel1.ru. The retrieved bytes are written to a temp path with a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmodded 755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Cover-story naming (markerPath 'analytics_state', a DISABLE_TELEMETRY opt-out, and a no-op _l logger) frames the dropper as telemetry. The fetch targets are not the package's publisher, the payload is opaque, and there is no integrity verification. The package name resembles legitimate Nx/Svelte tooling but the shipped code performs unauthenticated remote code execution on every installer that imports it.

    References: https://www.npmjs.com/package/devplatform-nx-svelte/v/35.6.8

    Affected packages

    Package

    Name: devplatform-nx-svelte

    Purl: pkg:npm/devplatform-nx-svelte

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.8