MAL-2026-13270

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-ui-notification/MAL-2026-13270.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13270
Published
2026-08-05T15:29:33Z
Modified
2026-08-05T16:50:26.301579356Z
Summary
Malicious code in devplatform-ui-notification (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7)

index.js unconditionally requires./compat on load, which selects a platform-specific asset path (linux/darwin/win32) and downloads bytes over HTTPS from string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT base64 fallback channel under *.dl.wel1.ru. The downloaded payload is written to /var/tmp (or the Windows TEMP directory) under a disguised name resembling dotnetdiag_*.exe /.cache_*, chmodded to 0755, and spawned detached via /bin/sh -c '<file> &' or cmd /c start with stdio ignored. Destination hosts are assembled from split string fragments (e.g. ["oob-worker.cf","103-070",".worker","s.","de","v"].join("")) and childprocess / chmodSync are required via string concatenation (require("child" + "process"), fs["chmod" + "Sync"]) to evade static URL and API scanning. The same download-then-execute chain is duplicated in lib/telemetry.js (81KB). There is no version pinning, no hash or signature verification, and the destinations are unrelated to a UI notification library.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.3.6"
            ],
            "id": "IN-MAL-2026-015719",
            "import_time": "2026-08-05T16:13:35.870731798Z",
            "modified_time": "2026-08-05T15:29:33Z",
            "source": "amazon-inspector",
            "sha256": "74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-ui-notification

Package

Name
devplatform-ui-notification
View open source insights on deps.dev
Purl
pkg:npm/devplatform-ui-notification

Affected ranges

Affected versions

35.*
35.3.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-vfZ/61mgB2P3Bmx3ugdTDGx+mUBXMpNoh46Piy6OUb8dD0P/m3I7RhV1W5/Slihox2XhDHOLB1OJN2N1w/eaeQ==",
                "sha1": "e92f4080ef33d8f07e9d53d314565bb7cb2e8bcd"
            },
            "filename": "devplatform-ui-notification-35.3.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "tlsh": "3ea1826a1666711887b09be4c6175416f55bf26373809294fb9c69881ff312482b2efc",
            "sha256": "fc643a35b2bc4ca51a27763a2ab119fbe34f76c3d9490be5b633e2e5afbbac33"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "46835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "adef07be70415f31552d0e492428697a508d9d149a24a63cb52c2a0ea3bb81e0"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-ui-notification/MAL-2026-13270.json"