MAL-2026-12758

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-feature-toggle/MAL-2026-12758.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12758
Published
2026-08-05T13:45:09Z
Modified
2026-08-05T14:36:57.320746059Z
Summary
Malicious code in devplatform-spa-feature-toggle (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1)

On require() of the package, index.js loads bridge.js, which selects a per-OS payload path, fetches an executable from a list of Cloudflare Workers hosts assembled via runtime string-splitting (e.g. ["oob-worker.cf101-adf.workers",".de","v"].join("")) with a DNS-TXT chunked-base64 fallback to hosts such as sdk.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under decoy names like.cache<hex> or dotnetdiag<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored. Additional cover-story markers include a.analyticsstate marker file and DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK env gates. The destination hosts are not the package's publisher infrastructure and the fetched bytes are opaque and executed without integrity verification.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:45:09Z",
            "source": "amazon-inspector",
            "sha256": "50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1",
            "import_time": "2026-08-05T14:19:53.880415159Z",
            "id": "IN-MAL-2026-015025",
            "versions": [
                "35.8.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-feature-toggle

Package

Name
devplatform-spa-feature-toggle
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-feature-toggle

Affected ranges

Affected versions

35.*
35.8.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-feature-toggle/MAL-2026-12758.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-spa-feature-toggle-35.8.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-DcAtHVCrv9TXTOM42tBc5YJuNM8hBiMfZYHGGKcx01a1MaaPZ9X4YDbIPMMlWnMuI+f5wsKVKCP/ZvEWk4l3Ww==",
                "sha1": "eae2bb03db9fc6a1f265c0c3d32e5f6fd29ac65a"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "10a1979a05b670198b7097e4871b8816f65bf6633380c284fb6c65985f77128c3b2dfc",
            "sha256": "b9b6b83098b592a41dc4b6804c6fa321f07959bd1d7f9253ca4e2ce1b5fe3248",
            "path": "_bridge.js"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]