MAL-2026-12673

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-ps-ded-ps-core/MAL-2026-12673.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12673
Published
2026-08-05T13:56:45Z
Modified
2026-08-05T14:36:19Z
Summary
Malicious code in ded-ps-ded-ps-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cfe3941502d9792a1ad46ba7ed447227ef74d1c45cce8e9996005218d47f0f51)

On require(), index.js loads init.js, which selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts whose names are assembled at runtime by joining split string fragments (e.g. oob-worker.cf1-01-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT covert-channel fallback to base64-chunked subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written to /tmp/.cache on Unix or %TEMP%/dotnet_diag_.exe on Windows — filenames chosen to mimic hidden cache and.NET diagnostics artifacts — then chmod 0755 and spawned detached via /bin/sh -c or cmd.exe start /b. lib/telemetry.js additionally constructs sensitive API names at runtime (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. Requiring the package causes arbitrary attacker-controlled native code to execute on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015103",
            "import_time": "2026-08-05T14:20:02.300494928Z",
            "modified_time": "2026-08-05T13:56:45Z",
            "sha256": "cfe3941502d9792a1ad46ba7ed447227ef74d1c45cce8e9996005218d47f0f51",
            "source": "amazon-inspector",
            "versions": [
                "35.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ded-ps-ded-ps-core

Package

Name
ded-ps-ded-ps-core
View open source insights on deps.dev
Purl
pkg:npm/ded-ps-ded-ps-core

Affected ranges

Affected versions

35.*
35.9.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_init.js",
            "sha256": "dd4428a60cc0d8951bfd661f5bdebabf6653cf3eb4fb3c5f881d7d2de460665e",
            "tlsh": "96a1c7aa11a670194b70dbe0cb175416f55bf6637380c284f79ca9981ff251483b2efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "ded-ps-ded-ps-core-35.9.1.tgz",
            "hashes": {
                "sha1": "ff4c6f187cd980b6451b33b183c20b102f55eb4d",
                "sha512_sri": "sha512-Z4QzNzaF0orQVig9tiBMpxyUGIVKT8gjN8rhE2q0NsNGDmqZm/q0oLWFDjGDPJhrUE1lQsdlKdCSMjSjcNQUeQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-ps-ded-ps-core/MAL-2026-12673.json"