MAL-2026-12782

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-thermostat/MAL-2026-12782.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12782
Published
2026-08-05T13:40:23Z
Modified
2026-08-05T14:37:08.686219382Z
Summary
Malicious code in devplatform-spa-plugin-thermostat (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7)

On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers subdomains under oob-worker.cfNNN-XXX.workers.dev (host strings reassembled from split arrays such as ["oob-worker.cf100-416.","work","er","s.","dev"].join("")) with a DNS-TXT base64-chunk fallback under *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under masquerading names (dotnetdiag<rand>.exe,.cache<rand>,.analyticsstate), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. No hash or signature verification is performed. Additional obfuscation reconstructs the childprocess require via 'child_' + 'process' concatenation. The package is published as a 'thermostat SPA plugin' but the fetched binary and infrastructure have no relation to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "versions": [
                "35.9.9"
            ],
            "sha256": "fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7",
            "import_time": "2026-08-05T14:19:50.201290142Z",
            "id": "IN-MAL-2026-014991",
            "modified_time": "2026-08-05T13:40:23Z"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-plugin-thermostat

Package

Name
devplatform-spa-plugin-thermostat
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-plugin-thermostat

Affected ranges

Affected versions

35.*
35.9.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-spa-plugin-thermostat-35.9.9.tgz",
            "hashes": {
                "sha1": "9a57fd68777ddc33579079150d36cba76b8992d5",
                "sha512_sri": "sha512-qhQYeyTbYsKcYPtVBBrnOKC2DQx9dNnFI9hxyNPwEfgXNFq4IvwBv/z/p7eDtKw7tcfr3ceivD6RWxHshgZyiQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "0a7a5f92b8f604e14821075f6d6cdac60160fb954f09799a0b42b07efba9a5a2",
            "tlsh": "d0a1b89b1676b0184bb0dbe0c61b5816f65af5633781c1c0f79ca9888f7752482b2efc",
            "path": "_compat.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-thermostat/MAL-2026-12782.json"