MAL-2026-12758

    Dashboard / Malicious Package / MAL-2026-12758

    MAL-2026-12758

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devplatform-spa-feature-toggle (npm)

    Details: Source: amazon-inspector (50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1) On require() of the package, index.js loads _bridge.js, which selects a per-OS payload path, fetches an executable from a list of Cloudflare Workers hosts assembled via runtime string-splitting (e.g. ["oob-worker.cf101-adf.workers",".de","v"].join("")) with a DNS-TXT chunked-base64 fallback to hosts such as sdk.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under decoy names like.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored. Additional cover-story markers include a.analytics_state marker file and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env gates. The destination hosts are not the package's publisher infrastructure and the fetched bytes are opaque and executed without integrity verification.

    References: https://www.npmjs.com/package/devplatform-spa-feature-toggle/v/35.8.4

    Affected packages

    Package

    Name: devplatform-spa-feature-toggle

    Purl: pkg:npm/devplatform-spa-feature-toggle

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.4
    MAL-2026-12758 | CVE-DB