MAL-2026-12706

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-cra-template/MAL-2026-12706.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12706
Published
2026-08-05T13:50:49Z
Modified
2026-08-05T14:36:34.646016245Z
Summary
Malicious code in devplatform-cra-template (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940)

On require('devplatform-cra-template'), index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one of three concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under names mimicking legitimate tooling (.cache<hex>, dotnetdiag<hex>.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Every network destination, the child_process require, and chmodSync are assembled from split-string arrays joined at runtime to defeat static analysis. A second, structurally identical dropper is shipped in lib/telemetry.js (~81 KB, disguised as an analytics SDK): base64-assembled bytes, chmod 755, cp.spawn('/bin/sh', ['-c', filePath + ' &'],...); it is not reachable from index.js in this version but is present in the tarball. The package name resembles the legitimate cra-template family, consistent with a typosquat lure delivering remote code to any consumer that requires it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:50:49Z",
            "id": "IN-MAL-2026-015063",
            "import_time": "2026-08-05T14:19:58.073669768Z",
            "sha256": "23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940",
            "versions": [
                "35.6.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-cra-template

Package

Name
devplatform-cra-template
View open source insights on deps.dev
Purl
pkg:npm/devplatform-cra-template

Affected ranges

Affected versions

35.*
35.6.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-cra-template-35.6.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-EPiqJvOqLxeYQDXyob0YNXeCESScnjZx7VHQ1T0W0wcKGUH2fmIwNv1L7B74ytFkU0JI3jO2TPWN+MTqtk+TxA==",
                "sha1": "fa1a854decd45cc0d5ede85d88c0a7484528eb99"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "8da197aa156a30194bb0e7e4c717541afa57f66333808295fb5ca5941fb2424c371efc",
            "sha256": "d9bdda18ceb9d23ad7ffda2d8d0616279903f918faa0e09aa409cebd509c0c0d",
            "path": "_bootstrap.js"
        },
        {
            "tlsh": "10835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "2e699108df8aed79f2a2b911689ba64db2f9e6dbd967784158c11af4a216878f",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-cra-template/MAL-2026-12706.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]