MAL-2026-12739

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-react-query-s3-client/MAL-2026-12739.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12739
Published
2026-08-05T13:46:06Z
Modified
2026-08-05T14:36:49.427314580Z
Summary
Malicious code in devplatform-react-query-s3-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6ce24f963296b5927f97e05940818b82e397479562fadd357e01c9137f449316)

On require()/import of devplatform-react-query-s3-client, index.js loads vendor.js which selects a platform-specific payload path (linuxx64, linuxarm64, darwin, win32), fetches a binary from one of four Cloudflare Workers hosts whose names are assembled at runtime via array-join obfuscation (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT base64 fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a deceptive name (.cache<hex> or dotnetdiag<hex>.exe impersonating.NET diagnostics), chmod 0755, and spawn-detached via /bin/sh -c '<path> &' or cmd.exe /c start. A second copy of the dropper (base64-chunk assembly, cp.spawn('/bin/sh', ['-c', filePath+' &']), fs.chmodSync(..., 0o755)) is duplicated in lib/telemetry.js under a ServiceDiscovery/WorkerHost class as an alternate loader. Opt-out env vars (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK) and a /tmp/.analyticsstate decoy provide a telemetry cover story; the destinations are hidden through string-split concatenation to defeat static grep. The payload is unpinned, unsigned, opaque, and delivered from hosts unrelated to any legitimate S3 or React Query SDK.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T14:19:54.440078899Z",
            "versions": [
                "35.8.7"
            ],
            "modified_time": "2026-08-05T13:46:06Z",
            "source": "amazon-inspector",
            "sha256": "6ce24f963296b5927f97e05940818b82e397479562fadd357e01c9137f449316",
            "id": "IN-MAL-2026-015031"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-react-query-s3-client

Package

Name
devplatform-react-query-s3-client
View open source insights on deps.dev
Purl
pkg:npm/devplatform-react-query-s3-client

Affected ranges

Affected versions

35.*
35.8.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "3cb1a556126a70188bb0ebe0c7179416f65bf653338192c4f7ac99945fb312883b2efc",
            "sha256": "be3c8366ef115e02e33fc3b30c6dd5c4515efb448fe6e95e4210a815dadcbc38",
            "path": "_vendor.js"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "134e82bd86458ee6f0133e432692996a49a026a5ee37e31a8c680183bb737b01",
            "tlsh": "e9835055566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-RqnQQoauK50042Ql+kRoJVBjjMjUvXk6Lr13qm65KrRQJ/1mypTvl8THV8mACOv+/9O0egr80HLrIl/lJM/pjQ==",
                "sha1": "08166e3e4ff78142935a2d287d851381180b5128"
            },
            "filename": "devplatform-react-query-s3-client-35.8.7.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-react-query-s3-client/MAL-2026-12739.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]