{"id":"MAL-2026-12746","summary":"Malicious code in devplatform-rest-resources-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316)\nOn require of devplatform-rest-resources-v2, index.js loads _adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime by joining split string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS TXT fallback resolving base64 payload locations from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as.cache_\u003chex\u003e on POSIX and dotnet_diag_\u003chex\u003e.exe on Windows, chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. A sibling lib/telemetry.js contains a second base64-\u003ewrite-\u003echmod-\u003espawn dropper skeleton. The hosts, filenames, and execution path are unrelated to any declared REST-resources purpose.\n","modified":"2026-08-05T14:36:52.914631977Z","published":"2026-08-05T13:44:53Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:19:53.64700563Z","modified_time":"2026-08-05T13:44:53Z","sha256":"51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316","source":"amazon-inspector","versions":["35.9.7"],"id":"IN-MAL-2026-015023"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-rest-resources-v2/v/35.9.7"}],"affected":[{"package":{"name":"devplatform-rest-resources-v2","ecosystem":"npm","purl":"pkg:npm/devplatform-rest-resources-v2"},"versions":["35.9.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-rest-resources-v2/MAL-2026-12746.json","indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"184bf8259b9952fd65674095a5fc2ca3a0eefb7af3c3586c6e27e322e89db017","tlsh":"d7a1b69a16a6301d8bb09be0cb175416f65bf6633781c294fb6ca5841f7212483b2efc"}],"package_integrity":[{"filename":"devplatform-rest-resources-v2-35.9.7.tgz","hashes":{"sha1":"36811cfff913c90fa90432ff6437ad24c0ca1461","sha512_sri":"sha512-aVlfOZMJk6mfm46LEw0vUF4Afpw9xiW/hJsZHJCRnxFC9rsjIYqFSDb5mkKwgoEt2o5JvXqp7s88gPhecFxxXw=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}