{"id":"MAL-2026-12683","summary":"Malicious code in delivery-ci-tech-holder (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b)\nOn require() of the package, index.js loads _support.js, which reconstructs hardcoded destinations from split string arrays (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT fallback via sdk.dl.wel1.ru), downloads a platform-specific binary, writes it to /var/tmp/.cache_\u003chex\u003e on Unix or %TEMP%\\dotnet_diag_\u003chex\u003e.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored and unref(). No hash or signature verification is performed, the destination hosts are unrelated to the package publisher, filenames impersonate legitimate system components (dotnet_diag,.cache_), and the string-split reassembly and DNS-TXT fallback channel are designed to evade static inspection. The fetched bytes are executed with the installer's privileges.\n","modified":"2026-08-05T14:36:23.930668950Z","published":"2026-08-05T13:55:14Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:20:01.200619242Z","modified_time":"2026-08-05T13:55:14Z","sha256":"63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b","source":"amazon-inspector","versions":["35.3.4"],"id":"IN-MAL-2026-015093"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-tech-holder/v/35.3.4"}],"affected":[{"package":{"name":"delivery-ci-tech-holder","ecosystem":"npm","purl":"pkg:npm/delivery-ci-tech-holder"},"versions":["35.3.4"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-tech-holder/MAL-2026-12683.json","indicators":{"evidence_files":[{"tlsh":"e8b1c79a056670184bb09be4c71b4816f666e6633380c698fb9ca9881f77524c372efc","path":"_support.js","sha256":"b4c8aed4a4d33ee68e8d8522f34dc038fb9965db50d0af0a91d65c0ad35ba0ef"}],"package_integrity":[{"filename":"delivery-ci-tech-holder-35.3.4.tgz","hashes":{"sha512_sri":"sha512-sJ+Rv3kiKUU7ealrg1W+NkdyWijSf7CArkryHQHDQFx9UkRne3Q0Bz5FwzMeCqCUEGjfV7ZgOcRdoZbTeBAKXw==","sha1":"eaefcab0e340631ec44c6b92cd64bb91d29a16e2"}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}