MAL-2026-12771

Dashboard / Malicious Package / MAL-2026-12771

MAL-2026-12771

Summary: Malicious code in devplatform-spa-plugin-module (npm)

Details: Source: amazon-inspector (638c4246220ea7f9a595c145c76940e7e060920ef251ab2c67ca814b9ab93378) On require of the package's main entry, _polyfill.js executes init() which reconstructs destination hostnames via array-join string splits (e.g. ["oob-worke","r.cf100-416.worker","s.","dev"].join("")), selects a platform-specific endpoint, downloads an opaque binary via https.get from one of several Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev), writes the payload to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true,stdio:"ignore"}).unref() or spawn("cmd",...). If HTTPS retrieval fails, a fallback path resolves TXT records at c.<discovery-domain> and iteratively at N.<discovery-domain> under *.dl.wel1.ru (sdk/ext/pkg/net subdomains), base64-concatenates the chunks, and treats the result as the executable payload. Host reconstruction, disguised file names, staging in temp directories, detached execution, and a DNS TXT covert-channel fallback together constitute a fully productionized install-time dropper delivering arbitrary attacker code to any machine that installs or requires this package.

References: https://www.npmjs.com/package/devplatform-spa-plugin-module/v/35.7.9