MAL-2026-13500

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-dpat/MAL-2026-13500.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13500
Published
2026-08-07T12:14:41Z
Modified
2026-08-07T12:35:09.149550524Z
Summary
Malicious code in delivery-ci-dpat (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f)

On require() of delivery-ci-dpat, _platform.js runs setup() at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a hidden path under /tmp or %TEMP%, chmods it 0o755, and spawns it detached via /bin/sh -c '<file> &' or cmd.exe /c start /b. A DNS-TXT covert channel provides a fallback delivery path: dnsChunked() queries c.<domain> under *.dl.wel1.ru for a chunk count, iterates 0..N.<domain> collecting base64-encoded TXT records, reassembles them into a binary buffer, and executes the reconstructed payload the same way. The C2 hostnames and DNS fallback domain are assembled at runtime from split-string fragments (['oob-worker.cf101-adf.worker','s.','dev'].join(''); ['sdk.dl.wel','1.r','u'].join('')) to evade static matching. A filesystem stamp is used for run-once dedup and the behavior is labeled as analytics/telemetry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f",
            "source": "amazon-inspector",
            "modified_time": "2026-08-07T12:14:41Z",
            "versions": [
                "35.1.5"
            ],
            "import_time": "2026-08-07T12:23:26.296652805Z",
            "id": "IN-MAL-2026-016898"
        }
    ]
}
References
Credits

Affected packages

npm / delivery-ci-dpat

Package

Name
delivery-ci-dpat
View open source insights on deps.dev
Purl
pkg:npm/delivery-ci-dpat

Affected ranges

Affected versions

35.*
35.1.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "b634e9c96c59d2d1e6ed1d98820ad4623326a9e8",
                "sha512_sri": "sha512-MgHEDOAl7lGTqn7odBa4eDA+3iPBXOhW7un9xK/4ukjvbnD0zCjbaDhRwlimaGmFY/igtjAAoTCsdsS2WJ/1ZA=="
            },
            "filename": "delivery-ci-dpat-35.1.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_platform.js",
            "sha256": "544ae2551542aabd106a908dd5d4d0862eca8c0393f024c5eb463116fe7f36a5",
            "tlsh": "e3a1989a16aa70084bb097e4c71b4819f65bf6633780c584f79c65985fb712483b2efc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-dpat/MAL-2026-13500.json"