MAL-2026-12774

    Dashboard / Malicious Package / MAL-2026-12774

    MAL-2026-12774

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devplatform-spa-plugin-query (npm)

    Details: Source: amazon-inspector (749fb409dca041d1e546949cfb546398db8752d59153c18e675f691231f3f1c0) On require() of the package, index.js loads _bootstrap.js, which assembles a C2 hostname by string-splitting fragments (oob-worker.cf*.workers.dev), selects a platform-specific payload path (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64), fetches opaque bytes over HTTPS, writes them to a temp path with cover-story names (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755 on Unix or launches via cmd /c start on Windows, and spawns the payload detached via /bin/sh -c. A DNS-TXT chunked-transfer channel (dnsChunked reading c.<domain> and i.<domain> TXT records over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) is provided as a covert fallback when HTTPS is blocked. No hash or signature verification is performed on the fetched binary.

    References: https://www.npmjs.com/package/devplatform-spa-plugin-query/v/35.8.5

    Affected packages

    Package

    Name: devplatform-spa-plugin-query

    Purl: pkg:npm/devplatform-spa-plugin-query

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.5
    MAL-2026-12774 | CVE-DB