MAL-2026-13275
Dashboard / Malicious Package / MAL-2026-13275
MAL-2026-13275
Summary: Malicious code in devplatform-zod-wip-api (npm)
Details: Source: amazon-inspector (2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492) [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./_vendor on load; _vendor.js runs at module load, reassembles a C2 hostname from split string fragments (oob-worker.cf99-9b3.workers.dev) with a DNS-TXT-record fallback to sdk.dl.wel1.ru, fetches a platform-specific native binary over HTTPS, writes it to /var/tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmods it 0755, and detached-spawns it via /bin/sh -c "<path> &" or cmd start /b. There is no signature or hash verification of the fetched bytes. A marker file at.analytics_state/analytics_state gates re-execution to roughly a 6-hour interval. A second parallel dropper implementation is shipped in lib/telemetry.js (assembles base64 chunks over DNS TXT, writes an 'extension' file, chmods 755, spawns /bin/sh). Hostname reassembly via.join(''), split-string obfuscation of DNS resolvers, and hidden filenames masquerading as OS cache/diagnostics files (.cache_, dotnet_diag_) indicate deliberate evasion rather than telemetry. On any require() of this package, arbitrary attacker-controlled native code executes on the installer's host.
Affected packages
Package
Name: devplatform-zod-wip-api
Purl: pkg:npm/devplatform-zod-wip-api
Affected ranges
Type: N/A
Events:
