MAL-2026-13271
Dashboard / Malicious Package / MAL-2026-13271
MAL-2026-13271
Summary: Malicious code in devplatform-utils (npm)
Details: Source: amazon-inspector (0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552) [email protected] ships an index.js whose main module require()s _bootstrap.js, which on load downloads a platform-specific binary payload from string-split-obfuscated Cloudflare Workers endpoints (e.g. oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback via *.dl.wel1.ru. The payload is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Destination hostnames are assembled at runtime by.join('') on fragmented string arrays (_NODES, _DNS_MAP) to evade static string scans, and the dropped file is given cover-story names (dotnet_diag_*,.cache_*,.analytics_state). A rate-limit token stored at /tmp/.analytics_state (EXPIRE_SEC=21227, ~5.9 hours) causes the remote binary to be re-fetched and re-executed on subsequent require() calls, providing a persistent operator-controlled code-delivery channel. Environment variables DISABLE_TELEMETRY / DO_NOT_TRACK are checked as a cover story consistent with a legitimate telemetry opt-out. No hash or signature verification is performed on the fetched binary.
Affected packages
Package
Name: devplatform-utils
Purl: pkg:npm/devplatform-utils
Affected ranges
Type: N/A
Events:
