{"id":"MAL-2026-13497","summary":"Malicious code in ded-pwa-c-page-maker-props (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da)\nOn require of the package, _compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers hosts (oob-worker.cf101/cf102/cf103-*.workers.dev, cf99-9b3.workers.dev), writes it to /tmp/.cache_\u003crand\u003e on POSIX or %TEMP%\\dotnet_diag_\u003crand\u003e.exe on Windows, chmods 0755, and spawns it detached via /bin/sh or cmd.exe. Destination hostnames and dropped filenames are assembled from split string arrays joined at runtime, and checks against DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as a cover story to gate the drop. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel: it queries c.\u003cdomain\u003e under *.dl.wel1.ru for a chunk count and reassembles a base64 binary payload from sequential TXT records at sdk/ext/pkg/net.dl.wel1.ru. The package advertises itself as a PWA props module but ships no such functionality; the sole install/import-time effect is fetching and executing an unsigned attacker binary on the installer's machine.\n","modified":"2026-08-07T12:35:27.332729189Z","published":"2026-08-07T12:11:39Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.7.7"],"id":"IN-MAL-2026-016877","import_time":"2026-08-07T12:23:25.415304744Z","modified_time":"2026-08-07T12:11:39Z","sha256":"4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-pwa-c-page-maker-props/v/35.7.7"}],"affected":[{"package":{"name":"ded-pwa-c-page-maker-props","ecosystem":"npm","purl":"pkg:npm/ded-pwa-c-page-maker-props"},"versions":["35.7.7"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"674c134c2a32dcf11407da45f28c36772ccc1864a2b869a02074add2bea047f0","tlsh":"80b1859a06ba7018cbf097e487175816f65be6632380c6a4fb6ca5841f7716483b2dfc","path":"_compat.js"}],"package_integrity":[{"hashes":{"sha1":"db9f6ddba0dcd191ae31b341ce75730aacfb4467","sha512_sri":"sha512-qqTKMnT0ldT85I9ksvPWsh7/gHRUaAq2hc1aHSDGd46lrHYCtLkSz0EmHlVX3QpjiP5RJmG4QxPVYJCHoPNZBg=="},"filename":"ded-pwa-c-page-maker-props-35.7.7.tgz"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-pwa-c-page-maker-props/MAL-2026-13497.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}