{"id":"MAL-2026-13535","summary":"Malicious code in ded-pwa-c-mapping (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18)\nOn require of the package, _helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS from string-concatenated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf102-baf, cf103-070, cf99-9b3) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames are assembled at runtime by joining fragments to defeat string scanners; a.analytics_state marker file throttles re-execution, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK opt-out variables are referenced to frame the behavior as telemetry. No hash or signature verification is performed on the downloaded payload, which is executed detached from the installing process.\n","modified":"2026-08-07T13:20:19.153583161Z","published":"2026-08-07T12:32:20Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017021","import_time":"2026-08-07T12:51:22.515706694Z","modified_time":"2026-08-07T12:32:20Z","sha256":"111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18","source":"amazon-inspector","versions":["35.8.7"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-pwa-c-mapping/v/35.8.7"}],"affected":[{"package":{"name":"ded-pwa-c-mapping","ecosystem":"npm","purl":"pkg:npm/ded-pwa-c-mapping"},"versions":["35.8.7"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"6cb1865a126570284b70ebe0c61b9425f66af6633681c5c4f75c99885fb36248373dfc","path":"_helpers.js","sha256":"feddfc1d284b3fb26a6104a096d65aeb31b396a1d250ced191cd5f2c6d0a7433"}],"package_integrity":[{"hashes":{"sha1":"084698f849f2b031cbcdd66136db23d5e01d348d","sha512_sri":"sha512-22D9LS2vnlNSPTb4hPkTkTlQdcz8hLdxtx2+PySC0zmFK6N45Odj16Jvcm7lIwEHmNAI9RtRTPcLon6mGkEjPw=="},"filename":"ded-pwa-c-mapping-35.8.7.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-pwa-c-mapping/MAL-2026-13535.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}