MAL-2026-12762

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-beaver/MAL-2026-12762.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12762
Published
2026-08-05T13:44:22Z
Modified
2026-08-05T14:36:59.246505094Z
Summary
Malicious code in devplatform-spa-plugin-beaver (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c4a35163a32dc9e4e60b1e9b09f33362ac19ea6e1486dfb4141a98a5263d1fa6)

On require(), the package's init.js selects a platform-specific URL from a set of Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are assembled from split-string fragments to evade static grep, downloads an opaque binary payload with no hash or signature verification, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows using filenames disguised as system diagnostics, chmods 0o755, and detach-spawns it via /bin/sh -c or cmd /c start with unref() so the child outlives the require. A DNS-TXT covert channel over subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru provides a fallback transport that reassembles base64 chunks from numbered TXT records, bypassing HTTP egress filtering. Execution is gated by cover-story opt-outs (DISABLETELEMETRY / ANALYTICSOPTOUT / DONOTTRACK) and a ~6h TTL marker at /tmp/.analyticsstate or %TEMP%\analytics_state so the dropper fires once per fresh host to reduce detection surface. The fetched bytes have no relation to the advertised 'spa plugin' function, and the fetch destinations are neither the npm registry nor a publisher-matched vendor host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "c4a35163a32dc9e4e60b1e9b09f33362ac19ea6e1486dfb4141a98a5263d1fa6",
            "versions": [
                "35.2.2"
            ],
            "import_time": "2026-08-05T14:19:53.232385783Z",
            "modified_time": "2026-08-05T13:44:22Z",
            "id": "IN-MAL-2026-015019"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-plugin-beaver

Package

Name
devplatform-spa-plugin-beaver
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-plugin-beaver

Affected ranges

Affected versions

35.*
35.2.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "7b7d013c5decb6584910e665beb6016a45d135a2",
                "sha512_sri": "sha512-xvPiN8fDK6B5pkDtX8s2k1oIGR9KHoEHD8lFAh+yd3jOSQW0kxBUoC7GR1KxP9EIpYRleW56IjnMAJXBz6fNwA=="
            },
            "filename": "devplatform-spa-plugin-beaver-35.2.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "sha256": "615db204c1d55a33b53c5d6d38401ccc2ced982a0b38ad29af8be49d9cd01ed6",
            "tlsh": "89a1b756166670188bb09be487174416f66bf6633381c288fb9ca5881f731388373efc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-beaver/MAL-2026-12762.json"