MAL-2026-13276

    Dashboard / Malicious Package / MAL-2026-13276

    MAL-2026-13276

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dippy-invertor (npm)

    Details: Source: amazon-inspector (e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451) On `require('dippy-invertor')`, index.js unconditionally loads _ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers hosts (oob-worker.cf10*.workers.dev family) and, on HTTPS failure, falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (queries TXT at `c.<domain>` for a chunk count, iterates `0.<domain>`..`N.<domain>`, base64-decodes the concatenation). The retrieved payload is written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmod 0755, and spawned detached and unref'd via `/bin/sh -c` or `cmd`. Hostnames and the `child_process` / `chmodSync` API names are split-concatenated (`[...].join('')`) to evade string scanning, and cover-story identifiers (`analytics_state`, `DISABLE_TELEMETRY`, `dotnet_diag_*.exe`) disguise the loader. The package has no legitimate advertised behavior that requires fetching and executing an opaque remote binary at load time.

    References: https://www.npmjs.com/package/dippy-invertor/v/35.1.6

    Affected packages

    Package

    Name: dippy-invertor

    Purl: pkg:npm/dippy-invertor

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.1.6