MAL-2026-12752

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-select-user/MAL-2026-12752.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12752
Published
2026-08-05T13:45:19Z
Modified
2026-08-05T14:36:55.344096882Z
Summary
Malicious code in devplatform-select-user (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e2f7e22a3a99d2447b8bc3e6c0b1f4a92077ce570fdacff421e9fdee6a83e723)

On require(), the package loads bridge.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), writes it to /var/tmp or %TEMP% under cover-story names such as.cache<hex> and dotnetdiag<hex>.exe, chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &']) on POSIX or cmd on Windows. Destination hostnames are reconstructed at runtime from split character arrays (['oob-worker.cf99-9b3.worke','rs.','de','v'].join('')) to evade string-based scanners. A DNS fallback channel resolves TXT records under *.dl.wel1.ru (assembled the same way in DNSMAP) to retrieve or exfiltrate chunked data when HTTPS is blocked. The package's advertised purpose is a 'select user' UI helper — there is no functional reason for it to fetch and execute an opaque native binary from anonymous Cloudflare Workers subdomains at import time. Cover-story comments ('Shuffle endpoints to distribute load', 'Clean up temporary files') and a DISABLE_TELEMETRY opt-out gate frame the dropper as diagnostics. Installing or importing this package results in attacker-controlled code executing on the host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015026",
            "import_time": "2026-08-05T14:19:53.964580372Z",
            "sha256": "e2f7e22a3a99d2447b8bc3e6c0b1f4a92077ce570fdacff421e9fdee6a83e723",
            "modified_time": "2026-08-05T13:45:19Z",
            "versions": [
                "35.4.4"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-select-user

Package

Name
devplatform-select-user
View open source insights on deps.dev
Purl
pkg:npm/devplatform-select-user

Affected ranges

Affected versions

35.*
35.4.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-TAw4lF4Cng5CTHG/nSRL9vnO+BL/o3/eU9tlrOj1CR3INYdjCPbTwVYciEP/7jbIvyAZIb6nk27Esc4VLvLVpw==",
                "sha1": "2ae4804fa3c8e5def4d7635405212e4a537f305c"
            },
            "filename": "devplatform-select-user-35.4.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_bridge.js",
            "sha256": "5f6a1ab3764bae37a268fba82cea60313f1e19f1e9e70fb7062206542b2d4d1f",
            "tlsh": "42a1845a05a670084bb0d7f4c717541af65bf26333808298f6ac65985fb252483f2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-select-user/MAL-2026-12752.json"