{"id":"MAL-2026-12706","summary":"Malicious code in devplatform-cra-template (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940)\nOn `require('devplatform-cra-template')`, index.js loads _bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one of three concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under names mimicking legitimate tooling (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Every network destination, the `child_process` require, and `chmodSync` are assembled from split-string arrays joined at runtime to defeat static analysis. A second, structurally identical dropper is shipped in lib/telemetry.js (~81 KB, disguised as an analytics SDK): base64-assembled bytes, chmod 755, `cp.spawn('/bin/sh', ['-c', filePath + ' &'],...)`; it is not reachable from index.js in this version but is present in the tarball. The package name resembles the legitimate `cra-template` family, consistent with a typosquat lure delivering remote code to any consumer that requires it.\n","modified":"2026-08-05T14:36:34.646016245Z","published":"2026-08-05T13:50:49Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.6.2"],"id":"IN-MAL-2026-015063","import_time":"2026-08-05T14:19:58.073669768Z","modified_time":"2026-08-05T13:50:49Z","sha256":"23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-cra-template/v/35.6.2"}],"affected":[{"package":{"name":"devplatform-cra-template","ecosystem":"npm","purl":"pkg:npm/devplatform-cra-template"},"versions":["35.6.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"devplatform-cra-template-35.6.2.tgz","hashes":{"sha1":"fa1a854decd45cc0d5ede85d88c0a7484528eb99","sha512_sri":"sha512-EPiqJvOqLxeYQDXyob0YNXeCESScnjZx7VHQ1T0W0wcKGUH2fmIwNv1L7B74ytFkU0JI3jO2TPWN+MTqtk+TxA=="}}],"evidence_files":[{"sha256":"d9bdda18ceb9d23ad7ffda2d8d0616279903f918faa0e09aa409cebd509c0c0d","tlsh":"8da197aa156a30194bb0e7e4c717541afa57f66333808295fb5ca5941fb2424c371efc","path":"_bootstrap.js"},{"path":"lib/telemetry.js","sha256":"2e699108df8aed79f2a2b911689ba64db2f9e6dbd967784158c11af4a216878f","tlsh":"10835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-cra-template/MAL-2026-12706.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}