MAL-2026-12736

Dashboard / Malicious Package / MAL-2026-12736

MAL-2026-12736

Summary: Malicious code in devplatform-react-hooks (npm)

Details: Source: amazon-inspector (7e5dd30e287186df59dd24c05aa269894c259f42c8a2a214d513e55c6510474e) On require() of the package's main entry (index.js -> _init.js), the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments joined at runtime (e.g. ['oob-worker.cf99-9b3.w','orkers.de','v'].join('')), rotates through oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS-TXT fallback under *.wel1.ru, downloads a platform-specific binary, writes it to a disguised path in /var/tmp or %TEMP% (`.cache_<hex>` on POSIX, `dotnet_diag_<hex>.exe` on Windows), sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Cover-story comments frame the behavior as cache/telemetry and offer DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var opt-outs. A second module, lib/telemetry.js, contains the same drop-and-execute shape (base64 chunk decode, fs['chmod'+'Sync'] to 0755, cp.spawn('/bin/sh', ['-c', filePath+' &'])) but is not reached from the declared main. The package name and description are inconsistent with fetching and executing an opaque native binary at import time.

References: https://www.npmjs.com/package/devplatform-react-hooks/v/35.5.7