MAL-2026-12779

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-s3-module-loader/MAL-2026-12779.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12779
Published
2026-08-05T13:41:14Z
Modified
2026-08-05T14:37:07.200646703Z
Summary
Malicious code in devplatform-spa-plugin-s3-module-loader (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a)

On require of the package's main entry, index.js loads adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) assembled from split string arrays, writes them to a hidden temp path (dot-file on Unix, dotnetdiag_*.exe on Windows), chmods 0755 on Unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. A DNS-over-TXT fallback resolves c.<domain>/i.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-reassembles a payload from numbered TXT records when HTTPS delivery is blocked. Destinations, delivery channels, and payloads are fully author-controlled, obfuscated via runtime string reassembly, and unrelated to the package's advertised S3-module-loader purpose. Cover-story identifiers include analyticsstate and DISABLETELEMETRY.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014997",
            "import_time": "2026-08-05T14:19:50.78855025Z",
            "sha256": "b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a",
            "modified_time": "2026-08-05T13:41:14Z",
            "versions": [
                "35.8.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-plugin-s3-module-loader

Package

Name
devplatform-spa-plugin-s3-module-loader
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-plugin-s3-module-loader

Affected ranges

Affected versions

35.*
35.8.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-bD/oxN/pEvV2GpFJQiYrTUBF6WbwiQL2Y8tUHUu20i5JMBX9nM1E2d9TelDtzdFGzzdOCmg5NJOGzPctqcGzCA==",
                "sha1": "31f3dd7e3730bc30dccf5ed812cb8a06c20cbe50"
            },
            "filename": "devplatform-spa-plugin-s3-module-loader-35.8.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "sha256": "505e373fcfff9f931975d9e3558026debc16c3e238fb6e342bc2738f4a8c65e7",
            "tlsh": "59a1a7aa15a5701847b0dbe4c6075819f656f6633380d198fb9ca9981fb312483b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-s3-module-loader/MAL-2026-12779.json"