MAL-2026-12772

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-module-loader/MAL-2026-12772.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12772
Published
2026-08-05T13:42:02Z
Modified
2026-08-05T14:37:03.353717210Z
Summary
Malicious code in devplatform-spa-plugin-module-loader (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8)

On require, index.js unconditionally loads platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from subdomains of dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmod 0755, and detached-spawned via cp.spawn('/bin/sh', ['-c', fp+' &']) or the Windows equivalent. Destination hostnames and the childprocess API name are assembled by joining split string fragments (e.g. ['sdk.','dl.wel1.','ru'].join('')); dropped-file names mimic legitimate cache/diagnostic paths; cover-story comments reference SHA-256 integrity checks and rate limiting with no matching code; an opt-out env var (DISABLETELEMETRY) frames the behavior as analytics. The workers.dev destinations are anonymous, mutable, and unrelated to any legitimate publisher of a module-loader package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.5"
            ],
            "import_time": "2026-08-05T14:19:51.610496139Z",
            "sha256": "902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8",
            "modified_time": "2026-08-05T13:42:02Z",
            "id": "IN-MAL-2026-015003",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-plugin-module-loader

Package

Name
devplatform-spa-plugin-module-loader
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-plugin-module-loader

Affected ranges

Affected versions

35.*
35.8.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-302k8yU5cSfD2SFXNEi+ZJoII06DXnzX4ReOJ5LFf2gWs6yqcnKVexAoYoeHsChfB2Nj9PmJngWaGflhIXjzkA==",
                "sha1": "36a47528c269787c8a60a6ff17c449aa22904e22"
            },
            "filename": "devplatform-spa-plugin-module-loader-35.8.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_platform.js",
            "sha256": "d7fe9d04211e91353e5087cce670e0ac6ab70ab3aa4c7911d514177cf3fe5e62",
            "tlsh": "2ca1879a116670188bb09be4c7275416f65ff6633380c2d4fb5ca9941fb612483b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-module-loader/MAL-2026-12772.json"