MAL-2026-12746

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-rest-resources-v2/MAL-2026-12746.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12746
Published
2026-08-05T13:44:53Z
Modified
2026-08-05T14:36:52.914631977Z
Summary
Malicious code in devplatform-rest-resources-v2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316)

On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime by joining split string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS TXT fallback resolving base64 payload locations from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as.cache<hex> on POSIX and dotnetdiag<hex>.exe on Windows, chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. A sibling lib/telemetry.js contains a second base64->write->chmod->spawn dropper skeleton. The hosts, filenames, and execution path are unrelated to any declared REST-resources purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:44:53Z",
            "source": "amazon-inspector",
            "sha256": "51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316",
            "import_time": "2026-08-05T14:19:53.64700563Z",
            "id": "IN-MAL-2026-015023",
            "versions": [
                "35.9.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-rest-resources-v2

Package

Name
devplatform-rest-resources-v2
View open source insights on deps.dev
Purl
pkg:npm/devplatform-rest-resources-v2

Affected ranges

Affected versions

35.*
35.9.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-rest-resources-v2/MAL-2026-12746.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-rest-resources-v2-35.9.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-aVlfOZMJk6mfm46LEw0vUF4Afpw9xiW/hJsZHJCRnxFC9rsjIYqFSDb5mkKwgoEt2o5JvXqp7s88gPhecFxxXw==",
                "sha1": "36811cfff913c90fa90432ff6437ad24c0ca1461"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d7a1b69a16a6301d8bb09be0cb175416f65bf6633781c294fb6ca5841f7212483b2efc",
            "sha256": "184bf8259b9952fd65674095a5fc2ca3a0eefb7af3c3586c6e27e322e89db017",
            "path": "_adapter.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]