MAL-2026-12681

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-storybook/MAL-2026-12681.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12681
Aliases
  • GHSA-vjwx-6r34-p6jx
Published
2026-08-05T13:54:03Z
Modified
2026-08-06T01:20:24.456043726Z
Summary
Malicious code in delivery-ci-storybook (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069)

On require() of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) whose hostnames are reconstructed at runtime from split string fragments joined with empty separators. If the HTTP fetch fails, a fallback path reassembles base64 chunks from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. No hash or signature verification is performed and the destinations are not publisher-controlled infrastructure. The fetched executable is attacker-controlled content executed on the installer's host at package require time.

Source: ghsa-malware (36e6b52931021e2a924b3e2419dc9d17dd14a86a737cedfe78ed3390995091b4)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069",
            "versions": [
                "35.5.8"
            ],
            "import_time": "2026-08-05T14:20:00.25458629Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:54:03Z",
            "id": "IN-MAL-2026-015085"
        },
        {
            "sha256": "36e6b52931021e2a924b3e2419dc9d17dd14a86a737cedfe78ed3390995091b4",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "import_time": "2026-08-06T00:58:53.458990544Z",
            "source": "ghsa-malware",
            "modified_time": "2026-08-05T14:57:26Z",
            "id": "GHSA-vjwx-6r34-p6jx"
        }
    ]
}
References
Credits

Affected packages

npm / delivery-ci-storybook

Package

Name
delivery-ci-storybook
View open source insights on deps.dev
Purl
pkg:npm/delivery-ci-storybook

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

35.*
35.5.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "b6be7cc22b9253c7b79e2d8d17e1f831af84af306cc77c01e30748f42e41277a",
            "tlsh": "52a188aa06a6700987b0dbe4c6175425f65bf6637380d1d4fb5c69881fb612483b2efc",
            "path": "_bridge.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "delivery-ci-storybook-35.5.8.tgz",
            "hashes": {
                "sha1": "651c29cfedf207bd689b6e9e11b536022d83fdcb",
                "sha512_sri": "sha512-X4vOXTLxmK61RuIdsTkpxUTD5bz2+Y/Eru2YwLieJdsXHRU6na+ljDhvc3Jov3ihkqqVKVof5wJenE4L/kZemw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-storybook/MAL-2026-12681.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]