{"id":"MAL-2026-13262","summary":"Malicious code in devplatform-spa-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428)\nOn require, `_vendor.js` selects a per-OS payload URL, fetches a binary from rotating `*.workers.dev` hosts (with a DNS-TXT base64 fallback via `*.dl.wel1.ru`), writes it to a hidden temp path (`.cache_\u003chex\u003e` on Unix, `dotnet_diag_\u003chex\u003e.exe` on Windows), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` or the Windows equivalent. Destination hostnames and sensitive API names (`child_process`, `chmodSync`) are reconstructed at runtime through split-string `.join('')` concatenation to evade scanners. `lib/telemetry.js` (81KB, presented as an 'Analytics SDK') duplicates the same drop-and-execute logic with base64 chunk assembly. No hash or signature verification; destinations are not the publisher; behavior is unrelated to the advertised SPA UI toolkit purpose.\n","modified":"2026-08-05T16:50:22.249637127Z","published":"2026-08-05T15:31:21Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015731","import_time":"2026-08-05T16:13:37.273698037Z","modified_time":"2026-08-05T15:31:21Z","sha256":"fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428","source":"amazon-inspector","versions":["35.8.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-spa-ui/v/35.8.2"}],"affected":[{"package":{"name":"devplatform-spa-ui","ecosystem":"npm","purl":"pkg:npm/devplatform-spa-ui"},"versions":["35.8.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-ui/MAL-2026-13262.json","indicators":{"package_integrity":[{"filename":"devplatform-spa-ui-35.8.2.tgz","hashes":{"sha512_sri":"sha512-AksjhwtAtsMkaARbZNjJFL2EUpzszH7LcJ0LLV05c3D2WbdsecEZlfed4ozO4VdWcb8ny7FpccNwXeqfMsJvcQ==","sha1":"62e7a383fac5ab2c13bfb0ff2681f9fe199b554c"}}],"evidence_files":[{"sha256":"4357a7c2b9f73dcd8905d1f1299487fc91653a4fca1402ad106cad4709dc1ccd","tlsh":"82b1a5a9066a70198b7097e487275816f55be5633380d294fb6c99881fb2534c3b2efc","path":"_vendor.js"},{"path":"lib/telemetry.js","sha256":"c58fdb04bfaf71ac77dcb01971d831a19a47b7717fba21a7997e8f32ff3164d8","tlsh":"eb835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}