MAL-2026-12774

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-query/MAL-2026-12774.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12774
Published
2026-08-05T13:41:40Z
Modified
2026-08-05T14:37:04.520756461Z
Summary
Malicious code in devplatform-spa-plugin-query (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (749fb409dca041d1e546949cfb546398db8752d59153c18e675f691231f3f1c0)

On require() of the package, index.js loads bootstrap.js, which assembles a C2 hostname by string-splitting fragments (oob-worker.cf*.workers.dev), selects a platform-specific payload path (/pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64), fetches opaque bytes over HTTPS, writes them to a temp path with cover-story names (e.g. dotnetdiag*.exe,.cache_*), chmods 0755 on Unix or launches via cmd /c start on Windows, and spawns the payload detached via /bin/sh -c. A DNS-TXT chunked-transfer channel (dnsChunked reading c.<domain> and i.<domain> TXT records over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) is provided as a covert fallback when HTTPS is blocked. No hash or signature verification is performed on the fetched binary.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015000",
            "import_time": "2026-08-05T14:19:51.135672464Z",
            "sha256": "749fb409dca041d1e546949cfb546398db8752d59153c18e675f691231f3f1c0",
            "modified_time": "2026-08-05T13:41:40Z",
            "versions": [
                "35.8.5"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-plugin-query

Package

Name
devplatform-spa-plugin-query
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-plugin-query

Affected ranges

Affected versions

35.*
35.8.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Az3/GVrRsuUB6kO5G+cIBfvXjvq+Cu4vKV1wdzZLs0Apv8kPNBdlVa6hCNLBWB9ak+nul5Ts5Gz4JBFS8Rc4vg==",
                "sha1": "6a959efb49e273cd056caeee10502d4f2e33be0d"
            },
            "filename": "devplatform-spa-plugin-query-35.8.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "0b8c2a50f67ea83b100bce4247182cb64e097d38f1b86e231f6b670ae6c4f15d",
            "tlsh": "81a1746615a970184bb0ebe4c7075419f65af76332808298f7ac65d81fb322483f2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-query/MAL-2026-12774.json"