MAL-2026-13502

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-react-mcp/MAL-2026-13502.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13502
Published
2026-08-07T12:12:04Z
Modified
2026-08-07T12:35:10.040259486Z
Summary
Malicious code in devplatform-react-mcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e)

devplatform-react-mcp@35.5.6 is a dropper disguised as a React MCP SDK. On require(), index.js loads helpers.js which assembles three Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) from small string fragments joined at runtime, downloads a platform-specific binary via https.get, writes it to /tmp/.cache<hex> or %TEMP%\dotnetdiag<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. A DNS-TXT fallback resolves further payload sources under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A second dropper pipeline in lib/telemetry.js repeats the same primitives (base64 chunk assembly, fs["chmod"+"Sync"], cp.spawn("/bin/sh",["-c", filePath+" &"])) behind an 'analytics SDK' cover story. Identifier strings such as child_process and chmodSync are concatenated at runtime to evade static analysis. There is no native-build purpose; the package is a stub SDK whose only observable behavior on load is fetching and executing an opaque attacker-controlled binary on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016880",
            "import_time": "2026-08-07T12:23:25.529986899Z",
            "versions": [
                "35.5.6"
            ],
            "modified_time": "2026-08-07T12:12:04Z",
            "sha256": "21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-react-mcp

Package

Name
devplatform-react-mcp
View open source insights on deps.dev
Purl
pkg:npm/devplatform-react-mcp

Affected ranges

Affected versions

35.*
35.5.6

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-react-mcp/MAL-2026-13502.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "fda1b69a06a670084bb09be5c7175416f66bf2633681d1c4f7ac99981f7313883b2efc",
            "sha256": "51f72554b90d467aa19afe69e1ccfcafd260d95d829cf37686158eda1dea49dc",
            "path": "_helpers.js"
        },
        {
            "tlsh": "9a835055566a242186b2b368df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "sha256": "5785c7c2f50c4295e502eb47faa4ce0b29a61ea499ccb49c37b33f02f4999b72",
            "path": "lib/telemetry.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "d24c8d062cd576230b908ca845450f08f9ca2e40",
                "sha512_sri": "sha512-IOdBnazWR/tHtdFOYDLHvjIff9y8sYtPCrtPP+Imw76TFK+n6y4dQB3uLPj1Ib5wEb+cA30nPVxGHmIxmbhcCQ=="
            },
            "filename": "devplatform-react-mcp-35.5.6.tgz"
        }
    ]
}