MAL-2026-13262
Dashboard / Malicious Package / MAL-2026-13262
MAL-2026-13262
Summary: Malicious code in devplatform-spa-ui (npm)
Details: Source: amazon-inspector (fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428) On require, `_vendor.js` selects a per-OS payload URL, fetches a binary from rotating `*.workers.dev` hosts (with a DNS-TXT base64 fallback via `*.dl.wel1.ru`), writes it to a hidden temp path (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` or the Windows equivalent. Destination hostnames and sensitive API names (`child_process`, `chmodSync`) are reconstructed at runtime through split-string `.join('')` concatenation to evade scanners. `lib/telemetry.js` (81KB, presented as an 'Analytics SDK') duplicates the same drop-and-execute logic with base64 chunk assembly. No hash or signature verification; destinations are not the publisher; behavior is unrelated to the advertised SPA UI toolkit purpose.
Affected packages
Package
Name: devplatform-spa-ui
Purl: pkg:npm/devplatform-spa-ui
Affected ranges
Type: N/A
Events:
