MAL-2026-13269

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-ui-kit/MAL-2026-13269.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13269
Aliases
  • GHSA-9cxc-5g3h-7j79
Published
2026-08-05T15:29:49Z
Modified
2026-08-06T01:20:40.497789667Z
Summary
Malicious code in devplatform-ui-kit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc)

Package advertised as a UI toolkit but on module load (index.js require()s adapter.js) fetches an opaque platform-specific binary from obfuscated *.workers.dev hosts, with a DNS-TXT covert-channel fallback that reassembles base64 chunks from subdomains under dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). Host strings are constructed at runtime by joining short fragments (e.g. ["oob-work","er.cf102-baf.workers.de","v"].join("")) to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under disguise names such as dotnetdiag_*.exe /.cache_*, chmodded 0755 on POSIX, and spawned detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}).unref() (cmd on Windows). No hash or signature verification. Behavior fires on any require()/import of the package, executing attacker-controlled code on the installer's machine.

Source: ghsa-malware (24684e246b0273b61611f68034228f87283759247582b25c073f212d03a9ca73)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.6.2"
            ],
            "id": "IN-MAL-2026-015721",
            "import_time": "2026-08-05T16:13:36.09319024Z",
            "modified_time": "2026-08-05T15:29:49Z",
            "source": "amazon-inspector",
            "sha256": "970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc"
        },
        {
            "modified_time": "2026-08-05T18:03:46Z",
            "id": "GHSA-9cxc-5g3h-7j79",
            "import_time": "2026-08-06T00:58:53.337266098Z",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "ghsa-malware",
            "sha256": "24684e246b0273b61611f68034228f87283759247582b25c073f212d03a9ca73"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-ui-kit

Package

Name
devplatform-ui-kit
View open source insights on deps.dev
Purl
pkg:npm/devplatform-ui-kit

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

35.*
35.6.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-ui-kit/MAL-2026-13269.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-ui-kit-35.6.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-Zx5TTPRJwmf9/pIL0jCfKWLhd0H/DUUIiV9+53BqXzV0JhamgLvU1JgZSdcxFifYA1pV/MR2PvnuUK/+sy0clA==",
                "sha1": "ddd2b34907dc259b394e162fe516b58ce44759a0"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "tlsh": "3da1a75a12a6701d8bb0dbe4c7175416f66be6633380c698fb9ca5844f7326483b1efc",
            "sha256": "5aac7da3d5e49e7d1244d431b3405ca86f64f0731628596bf3f044db525519b1"
        }
    ]
}