MAL-2026-13202
Dashboard / Malicious Package / MAL-2026-13202
MAL-2026-13202
Summary: Malicious code in dwhetlfront-dwhetlfront-core (npm)
Details: Source: amazon-inspector (fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f) On require() of the package, index.js loads _support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT chunked-base64 fallback under {sdk,ext,pkg,net}.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under a cover-story filename (dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns the file detached via cp.spawn('/bin/sh', ['-c', path + ' &'], {detached:true}) or spawn('cmd',...). Destination hostnames are reconstructed at runtime via array-join splits (e.g., ['sdk','.d','l.wel1','.r','u'].join('') and ['oob-w','orker.cf100-416.worker','s.','dev'].join('')) and API names such as 'child_' + 'process' are string-concatenated to evade static analysis. A lock file gates repeat execution and an opt-out env var serves as a cover story. A parallel dropper implementation exists in lib/telemetry.js (base64 chunk assembly, sh -c spawn, chmod 755 via bracketed 'chmod'+'Sync'); it is not reached from index.js in this version but is bundled in the tarball.
Affected packages
Package
Name: dwhetlfront-dwhetlfront-core
Purl: pkg:npm/dwhetlfront-dwhetlfront-core
Affected ranges
Type: N/A
Events:
