{"id":"MAL-2026-12709","summary":"Malicious code in devplatform-di (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9)\nOn require('devplatform-di'), index.js loads _compat.js which fetches a platform-specific executable from string-split-obfuscated hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), with a base64-chunk DNS TXT fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under cover-story filenames such as dotnet_diag_\u003crnd\u003e.exe and.cache_\u003crnd\u003e, chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe. Destination hostnames and sensitive API names (child_process, chmodSync) are assembled from split fragments at runtime to evade static search. lib/telemetry.js contains the same shape (require(\"child_\"+\"process\"), base64-decoded buffer, spawn /bin/sh, chmodSync 0755). The package presents itself as a trivial dependency-injection stub, unrelated to any legitimate native-binary requirement.\n","modified":"2026-08-05T14:36:35.932095254Z","published":"2026-08-05T13:51:17Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:19:58.337442293Z","modified_time":"2026-08-05T13:51:17Z","sha256":"e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9","source":"amazon-inspector","versions":["35.5.5"],"id":"IN-MAL-2026-015066"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-di/v/35.5.5"}],"affected":[{"package":{"name":"devplatform-di","ecosystem":"npm","purl":"pkg:npm/devplatform-di"},"versions":["35.5.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"607cc007f47b1eb8a374f6f9176fc3229e64ae4fc9abe3e5e8d4114a2efe6ec3","tlsh":"67a1a59a16a670184bb09be0c7175826f55bf2633781c2d4f79c65881fb352483b2efc"}],"package_integrity":[{"filename":"devplatform-di-35.5.5.tgz","hashes":{"sha512_sri":"sha512-T7+x2H6wdZZ/Pqwz3ZbfqsC4+yxeCWDRiptV+Tyiy5+zP2H8/XmuXGW1B/tV96bp4NXUFahyb8JeBoUseapoAg==","sha1":"f1f2f3513ecc9dc1450af1b0bfa7bc72d6d1cbcf"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-di/MAL-2026-12709.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}