MAL-2026-13497

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-pwa-c-page-maker-props/MAL-2026-13497.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13497
Published
2026-08-07T12:11:39Z
Modified
2026-08-07T12:35:27Z
Summary
Malicious code in ded-pwa-c-page-maker-props (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da)

On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers hosts (oob-worker.cf101/cf102/cf103-*.workers.dev, cf99-9b3.workers.dev), writes it to /tmp/.cache on POSIX or %TEMP%\dotnet_diag_.exe on Windows, chmods 0755, and spawns it detached via /bin/sh or cmd.exe. Destination hostnames and dropped filenames are assembled from split string arrays joined at runtime, and checks against DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as a cover story to gate the drop. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel: it queries c. under *.dl.wel1.ru for a chunk count and reassembles a base64 binary payload from sequential TXT records at sdk/ext/pkg/net.dl.wel1.ru. The package advertises itself as a PWA props module but ships no such functionality; the sole install/import-time effect is fetching and executing an unsigned attacker binary on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016877",
            "import_time": "2026-08-07T12:23:25.415304744Z",
            "modified_time": "2026-08-07T12:11:39Z",
            "sha256": "4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da",
            "source": "amazon-inspector",
            "versions": [
                "35.7.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ded-pwa-c-page-maker-props

Package

Name
ded-pwa-c-page-maker-props
View open source insights on deps.dev
Purl
pkg:npm/ded-pwa-c-page-maker-props

Affected ranges

Affected versions

35.*
35.7.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_compat.js",
            "sha256": "674c134c2a32dcf11407da45f28c36772ccc1864a2b869a02074add2bea047f0",
            "tlsh": "80b1859a06ba7018cbf097e487175816f65be6632380c6a4fb6ca5841f7716483b2dfc"
        }
    ],
    "package_integrity": [
        {
            "filename": "ded-pwa-c-page-maker-props-35.7.7.tgz",
            "hashes": {
                "sha1": "db9f6ddba0dcd191ae31b341ce75730aacfb4467",
                "sha512_sri": "sha512-qqTKMnT0ldT85I9ksvPWsh7/gHRUaAq2hc1aHSDGd46lrHYCtLkSz0EmHlVX3QpjiP5RJmG4QxPVYJCHoPNZBg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-pwa-c-page-maker-props/MAL-2026-13497.json"