{"id":"MAL-2026-13541","summary":"Malicious code in delivery-ci-documentation (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203)\nOn require('delivery-ci-documentation'), index.js loads _init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames at runtime by joining split string arrays, and downloads an opaque binary over HTTPS from oob-worker.cf10x-*.workers.dev hosts. When HTTPS retrieval fails, it falls back to a DNS TXT covert channel that reassembles a base64-encoded payload from numbered subdomains under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_\u003chex\u003e and dotnet_diag_\u003chex\u003e.exe, chmod 0755 on POSIX, and spawned detached via /bin/sh -c '\u003cpath\u003e &' or cmd.exe /c start /b. No hash or signature verification is performed, the URLs are mutable, the destination hosts do not match any legitimate publisher for a package advertised as a documentation abstraction, and both the staging paths and the transport are covert. The result is arbitrary attacker-controlled code execution on the installer's host on import.\n","modified":"2026-08-07T13:20:22.638650237Z","published":"2026-08-07T12:26:17Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-07T12:51:20.739193126Z","modified_time":"2026-08-07T12:26:17Z","sha256":"af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203","source":"amazon-inspector","versions":["35.3.7"],"id":"IN-MAL-2026-016980"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-documentation/v/35.3.7"}],"affected":[{"package":{"name":"delivery-ci-documentation","ecosystem":"npm","purl":"pkg:npm/delivery-ci-documentation"},"versions":["35.3.7"],"database_specific":{"indicators":{"evidence_files":[{"path":"_init.js","sha256":"ee9f9ccadfa16e38ea35ab216fce31573587658d9b03030d89201211894753ab","tlsh":"1da1885a166a70188bb0d7e4c7275416fa5bf66333c0c6d4fb5ca5981fb21248272efc"}],"package_integrity":[{"hashes":{"sha1":"04551d79f775c79847b8fc82e304a8eff5554cc3","sha512_sri":"sha512-wfkCO8Yy0UM0D26KDB8dVdjgPbjCBOLidZludkAUcYznAIaqXojZa0bf3JtPPlkcXha3g/idsA8lPQ7mTbnP/g=="},"filename":"delivery-ci-documentation-35.3.7.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-documentation/MAL-2026-13541.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}