MAL-2026-12682

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-storyshots/MAL-2026-12682.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12682
Published
2026-08-05T13:54:21Z
Modified
2026-08-05T14:36:23.842936459Z
Summary
Malicious code in delivery-ci-storyshots (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d34974cf17a445c363a201ebcc43e976f13072ebecd78c6c5cd59f2e0790f3eb)

index.js unconditionally requires./adapter on load. adapter.js selects a platform-specific endpoint and downloads an opaque binary over HTTPS from one of three Cloudflare Workers hosts assembled via split-string concatenation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), with a chunked-base64 DNS-TXT fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp under a hidden dotfile name (or to %TEMP% as dotnetdiag*.exe on Windows), chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe. No pin, no signature, no publisher-matched host. Destinations and dangerous APIs (require("child_"+"process"), fs["chmod"+"Sync"]) are reconstructed at runtime to evade static analysis. A sibling module lib/telemetry.js (~81KB) mirrors the same dropper primitives (base64 chunk assembly, sh -c spawn, chmodSync 0755) under an Analytics/observability cover story and is shipped as an alternate loader. Requiring or installing this package results in full-host remote code execution on the installer with attacker-controlled payload delivery.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "d34974cf17a445c363a201ebcc43e976f13072ebecd78c6c5cd59f2e0790f3eb",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:00.450814029Z",
            "modified_time": "2026-08-05T13:54:21Z",
            "versions": [
                "35.3.6"
            ],
            "id": "IN-MAL-2026-015087"
        }
    ]
}
References
Credits

Affected packages

npm / delivery-ci-storyshots

Package

Name
delivery-ci-storyshots
View open source insights on deps.dev
Purl
pkg:npm/delivery-ci-storyshots

Affected ranges

Affected versions

35.*
35.3.6

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "4626bf243c2850efd6524a13614a70e405a3d0da",
                "sha512_sri": "sha512-n27Tjy5qqLDfhPG8wldBslruuDBGmspUvpOeVXTcfYjTFCoHudhUOr+1kUHpwZPVTMtWmwORlQh0t2c6jlSfwQ=="
            },
            "filename": "delivery-ci-storyshots-35.3.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "sha256": "79c0c89fd72fa89575428e6418ec2fc0fc33ad413abd93016649c01bfed072b7",
            "tlsh": "11a1869a16aa70084bb097f5c71b5815f657f6633380c294fb9c55881f7752483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "22efa51ec5fcf4fa565f4e26d4b5dc7faa5738b11385b82a59ca7c97e8314d43",
            "tlsh": "86835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-storyshots/MAL-2026-12682.json"