{"id":"MAL-2026-12779","summary":"Malicious code in devplatform-spa-plugin-s3-module-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a)\nOn require of the package's main entry, index.js loads _adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) assembled from split string arrays, writes them to a hidden temp path (dot-file on Unix, dotnet_diag_*.exe on Windows), chmods 0755 on Unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. A DNS-over-TXT fallback resolves c.\u003cdomain\u003e/i.\u003cdomain\u003e under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-reassembles a payload from numbered TXT records when HTTPS delivery is blocked. Destinations, delivery channels, and payloads are fully author-controlled, obfuscated via runtime string reassembly, and unrelated to the package's advertised S3-module-loader purpose. Cover-story identifiers include analytics_state and DISABLE_TELEMETRY.\n","modified":"2026-08-05T14:37:07.200646703Z","published":"2026-08-05T13:41:14Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014997","import_time":"2026-08-05T14:19:50.78855025Z","modified_time":"2026-08-05T13:41:14Z","sha256":"b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a","source":"amazon-inspector","versions":["35.8.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-spa-plugin-s3-module-loader/v/35.8.2"}],"affected":[{"package":{"name":"devplatform-spa-plugin-s3-module-loader","ecosystem":"npm","purl":"pkg:npm/devplatform-spa-plugin-s3-module-loader"},"versions":["35.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"505e373fcfff9f931975d9e3558026debc16c3e238fb6e342bc2738f4a8c65e7","tlsh":"59a1a7aa15a5701847b0dbe4c6075819f656f6633380d198fb9ca9981fb312483b2efc"}],"package_integrity":[{"hashes":{"sha1":"31f3dd7e3730bc30dccf5ed812cb8a06c20cbe50","sha512_sri":"sha512-bD/oxN/pEvV2GpFJQiYrTUBF6WbwiQL2Y8tUHUu20i5JMBX9nM1E2d9TelDtzdFGzzdOCmg5NJOGzPctqcGzCA=="},"filename":"devplatform-spa-plugin-s3-module-loader-35.8.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-s3-module-loader/MAL-2026-12779.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}