MAL-2026-12683

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-tech-holder/MAL-2026-12683.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12683
Published
2026-08-05T13:55:14Z
Modified
2026-08-05T14:36:23.930668950Z
Summary
Malicious code in delivery-ci-tech-holder (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b)

On require() of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT fallback via sdk.dl.wel1.ru), downloads a platform-specific binary, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored and unref(). No hash or signature verification is performed, the destination hosts are unrelated to the package publisher, filenames impersonate legitimate system components (dotnetdiag,.cache), and the string-split reassembly and DNS-TXT fallback channel are designed to evade static inspection. The fetched bytes are executed with the installer's privileges.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:55:14Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015093",
            "import_time": "2026-08-05T14:20:01.200619242Z",
            "sha256": "63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b",
            "versions": [
                "35.3.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / delivery-ci-tech-holder

Package

Name
delivery-ci-tech-holder
View open source insights on deps.dev
Purl
pkg:npm/delivery-ci-tech-holder

Affected ranges

Affected versions

35.*
35.3.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-tech-holder/MAL-2026-12683.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "delivery-ci-tech-holder-35.3.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-sJ+Rv3kiKUU7ealrg1W+NkdyWijSf7CArkryHQHDQFx9UkRne3Q0Bz5FwzMeCqCUEGjfV7ZgOcRdoZbTeBAKXw==",
                "sha1": "eaefcab0e340631ec44c6b92cd64bb91d29a16e2"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "e8b1c79a056670184bb09be4c71b4816f666e6633380c698fb9ca9881f77524c372efc",
            "sha256": "b4c8aed4a4d33ee68e8d8522f34dc038fb9965db50d0af0a91d65c0ad35ba0ef",
            "path": "_support.js"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]