MAL-2026-12707

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-create-nx-spa/MAL-2026-12707.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12707
Published
2026-08-05T13:51:55Z
Modified
2026-08-05T14:36:34.928623412Z
Summary
Malicious code in devplatform-create-nx-spa (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464)

devplatform-create-nx-spa@35.4.9 ships an index.js main entry that silently require()s _bridge.js, which on load assembles Cloudflare Workers hostnames (oob-worker.cf10{0,1,2,3}-*.workers.dev) and a fallback DNS-TXT channel to *.dl.wel1.ru from split-string arrays joined at runtime, downloads an unsigned opaque binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755s it, and spawns it detached via spawn('/bin/sh', ['-c', <path>+' &'], {detached:true}) or spawn('cmd',...). The behavior is disguised as "analytics" and gated by an /tmp/.analytics_state timestamp. The child_process identifier and destination hostnames are assembled from 3-4 substring pieces (['oob-worker.cf103-070.wor','ke','rs.dev'].join(''), require('child_'+'process')) to defeat static string matching. The package presents itself as a lightweight Nx SPA scaffolder, but its main module's only load-time effect is to fetch and execute attacker-controlled code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:51:55Z",
            "source": "amazon-inspector",
            "sha256": "6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464",
            "import_time": "2026-08-05T14:19:58.878424752Z",
            "id": "IN-MAL-2026-015071",
            "versions": [
                "35.4.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-create-nx-spa

Package

Name
devplatform-create-nx-spa
View open source insights on deps.dev
Purl
pkg:npm/devplatform-create-nx-spa

Affected ranges

Affected versions

35.*
35.4.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-create-nx-spa-35.4.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-UCK24J8Th5TLTFxAj5YN8A+m82pZ2CCBesClBfQoLkTpbTAmk+Kc0J0PTWaJJxN3ggNmerdi8W4HZeBdujbA6A==",
                "sha1": "a133614540ab57effae3ae9eef5fbb04e9b0e401"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "00a1c69a126670184bb0d7e4c71b8816f616f6a33781c2c8f79c55984fb342483b2efc",
            "sha256": "ce8470e3516445061ee0745c3f118c14c260c9eb3a278f1d4d24aacee8aee842",
            "path": "_bridge.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-create-nx-spa/MAL-2026-12707.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]