MAL-2026-12696

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-api-v2-resources/MAL-2026-12696.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12696
Published
2026-08-05T13:52:41Z
Modified
2026-08-05T14:36:30.265640941Z
Summary
Malicious code in devplatform-api-v2-resources (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (186e6a9062d157dd85fb6e2ec2fc4a81294569d2cca0c2ade69f2e97075616ed)

On require() of devplatform-api-v2-resources@35.3.8, index.js loads./polyfill.js, which downloads a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf1*-*.workers.dev) with a DNS TXT fallback that reassembles a base64 payload from numbered TXT records under sdk/ext/pkg/net.dl.wel1.ru. Destination hostnames are constructed at runtime by joining split-string fragments (e.g. ["oob-worker.cf101-adf.wor","kers",".de","v"].join("")) to evade static analysis. The fetched bytes are written to /tmp/.cache<hex> or %TEMP%\dotnetdiag<hex>.exe with disguised names, chmod 0755, and spawned detached via cp.spawn("/bin/sh",["-c", fp+" &"], {detached:true}).unref() (or spawn("cmd",...) on Windows). A cache stamp suppresses re-download within a TTL. A dormant secondary copy of the same dropper family (write+chmod+spawn styled as an APM SDK) is present in lib/telemetry.js but is not reached from the current loader graph. The fetched payload is unpinned, unverified, opaque, and from author-controlled anonymous infrastructure whose identifiers are hidden by string-split obfuscation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "186e6a9062d157dd85fb6e2ec2fc4a81294569d2cca0c2ade69f2e97075616ed",
            "versions": [
                "35.3.8"
            ],
            "import_time": "2026-08-05T14:19:59.404760266Z",
            "modified_time": "2026-08-05T13:52:41Z",
            "id": "IN-MAL-2026-015076"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-api-v2-resources

Package

Name
devplatform-api-v2-resources
View open source insights on deps.dev
Purl
pkg:npm/devplatform-api-v2-resources

Affected ranges

Affected versions

35.*
35.3.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "816988156c49f4db548af40feb7b1ed3a1584323",
                "sha512_sri": "sha512-/I8ptsk2T0q5yjfs9m1rqcZ+SNGx1tKICHbAodBlUQr8VOQZGfZ8rfwZDy/pXjRqHUPalAhZPGbK9SiPnZwedw=="
            },
            "filename": "devplatform-api-v2-resources-35.3.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "sha256": "ed87482444ff465a221bad8f1ce28f50cedf56e0df3ead209eb38c69f99a9346",
            "tlsh": "2ea1b996126670184bb0a7e4c72b5416f65be66337c0c294f79ca5981fb7128c372efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "bc2e0d309344cba57d67cd8f90da0c4470c1fb5ac357d4b1cf5371c8c06eb00a",
            "tlsh": "19835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-api-v2-resources/MAL-2026-12696.json"