MAL-2026-13496
Dashboard / Malicious Package / MAL-2026-13496
MAL-2026-13496
Summary: Malicious code in ded-pwa-c-cms (npm)
Details: Source: amazon-inspector (49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b) On require('ded-pwa-c-cms'), index.js loads _platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from obfuscated author-controlled hosts (Cloudflare Workers subdomains such as oob-worker.cf*-*.workers.dev and *.dl.wel1.ru subdomains including sdk/ext/pkg/net), with a DNS-TXT chunked base64 fallback channel (count read from c.<domain>, chunks read from i.<domain>). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or the cmd equivalent). C2 hostnames are reassembled at runtime from split-string arrays joined with.join(''), and execution is gated behind DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks as a telemetry cover story. The package advertises itself as a pluggable CMS interface with no dependencies and no legitimate need for a native binary; the dotnet_diag filename masquerades as a Microsoft diagnostic tool. No hash/signature verification is performed on the fetched payload.
Affected packages
Package
Name: ded-pwa-c-cms
Purl: pkg:npm/ded-pwa-c-cms
Affected ranges
Type: N/A
Events:
