MAL-2026-12718

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-jscodeshift-transforms/MAL-2026-12718.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12718
Published
2026-08-05T13:49:21Z
Modified
2026-08-05T14:36:40.096018654Z
Summary
Malicious code in devplatform-jscodeshift-transforms (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151)

On require() of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (destinations reconstructed via string-split concatenation such as ["oob-worker.cf102-b","af.workers.","de","v"].join("")), writes it to /var/tmp or %TEMP% under disguised names like dotnetdiag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. When HTTPS retrieval fails, shim.js falls back to a DNS-TXT covert channel: it resolves TXT records on numbered subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-reassembles the responses into the executable buffer. API names (require("child" + "process"), fs["chmod" + "Sync"]) are likewise split to evade static analysis, and env-var checks (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK) plus cover-story identifiers (analyticsstate, telemetry.js) frame the loader as benign analytics. The package name mimics an internal jscodeshift transforms wrapper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151",
            "id": "IN-MAL-2026-015053",
            "modified_time": "2026-08-05T13:49:21Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:19:57.028481463Z",
            "versions": [
                "35.9.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-jscodeshift-transforms

Package

Name
devplatform-jscodeshift-transforms
View open source insights on deps.dev
Purl
pkg:npm/devplatform-jscodeshift-transforms

Affected ranges

Affected versions

35.*
35.9.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "939f3d8feac540d6ada7eef56412190fe59f34889afa2832361c6e18c6934e66",
            "path": "_shim.js",
            "tlsh": "12a1a75a166630298bb0abf4c6174416f75af6633380c194f75c69985fb3528c372efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-PHnyjd2JwJ04H70+pD8bCOC6RXiwO4upYXj9oKMVHKPs25Ff2m/IEyrZaSXvxQ13tretdC1ufJhKKewQXy7neQ==",
                "sha1": "01ca2205c80c71d716650c4d78351ac8f74ae88b"
            },
            "filename": "devplatform-jscodeshift-transforms-35.9.5.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-jscodeshift-transforms/MAL-2026-12718.json"