MAL-2026-12757

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-di/MAL-2026-12757.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12757
Published
2026-08-05T13:43:22Z
Modified
2026-08-05T14:36:57.031825714Z
Summary
Malicious code in devplatform-spa-di (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0b547ced93ce179bd009fd7e88e23e19ba63fdb224d9b32c62588f05a3fd40f5)

On require('devplatform-spa-di'), index.js loads polyfill.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), with a DNS-TXT base64 fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp/.cache<rand> on POSIX or %TEMP%\dotnetdiag<rand>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Host strings and DNS domains are reconstructed at runtime by joining split array fragments (e.g. ["oob-worker.cf100-416.worke","rs.dev"].join("")) and cover-story comments frame the dropper as telemetry, with DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK env-var gates and an EXPIRESEC mtime stamp implementing dormancy and once-per-host gating. No hash or signature verification is performed. The package's advertised purpose is a small SPA dependency-injection helper, unrelated to native binary execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:43:22Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015013",
            "import_time": "2026-08-05T14:19:52.632511413Z",
            "sha256": "0b547ced93ce179bd009fd7e88e23e19ba63fdb224d9b32c62588f05a3fd40f5",
            "versions": [
                "35.5.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-di

Package

Name
devplatform-spa-di
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-di

Affected ranges

Affected versions

35.*
35.5.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-spa-di-35.5.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-bAXwoHdk8j68GcSW5v0levtNyGawCLBeQcKeedv4HkSW0u3A//qYP/rOBT9gDp16G0KW26FvpYCuj/dh9z5bmQ==",
                "sha1": "356bf1a2b92f7c53c1d5857166012006eed9b1dd"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "5ba1846a12a670098770d7e4c6175416f65af6637780c294fb9ca9885ff312483f2efc",
            "sha256": "1e45502c735ddfcc0c0b7dee60a73e108c4fa262d0ba166f55c932ebe14f6f77",
            "path": "_polyfill.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-di/MAL-2026-12757.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]