MAL-2026-13540

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-core/MAL-2026-13540.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13540

Published

2026-08-07T12:32:53Z

Modified

2026-08-07T13:20:09.868302815Z

Summary

Malicious code in delivery-ci-core (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335)

index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) from split string arrays, with a DNS TXT-record fallback under *.dl.wel1.ru that base64-reassembles the payload. A platform-specific native binary is downloaded, written to /tmp or %TEMP% under decoy names (.cache<hex>, dotnetdiag<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Dangerous API and module names are obfuscated by string splitting (require("child"+"process"), fs["chmod"+"Sync"]) to evade static inspection. lib/telemetry.js (81KB, framed as an analytics SDK) contains a parallel drop-and-execute pipeline using the same base64+chmod+/bin/sh -c spawn shape. Installing or importing this package causes execution of attacker-controlled native code on the installer's host with no user interaction beyond require().

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:32:53Z",
            "sha256": "8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335",
            "id": "IN-MAL-2026-017025",
            "versions": [
                "35.3.7"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-07T12:51:22.737198355Z"
        }
    ]
}

References

https://www.npmjs.com/package/delivery-ci-core/v/35.3.7

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / delivery-ci-core

Package

Name: delivery-ci-core; View open source insights on deps.dev
Purl: pkg:npm/delivery-ci-core

Affected ranges

Affected versions

35.*

35.3.7

Database specific

cwes

[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "evidence_files": [
        {
            "tlsh": "f8a1859612aa70294bb09bf4c6175416f657f6633780c2d8fb9ca9941f72124c3b2efc",
            "sha256": "0189046bc2ea2c4749406de5aa13bc6cddeee8647d7a1226f6c08848311b1dd3",
            "path": "setup.js"
        },
        {
            "tlsh": "01835055566a242186b2b368df234007ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "8b66dccd5b86f01dcdb10862e056b838dc8489b80726f29febb3e74d63295036",
            "path": "lib/telemetry.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "delivery-ci-core-35.3.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-qjrHE6oZfXiZj4A0mAj7ytog+RP9uoedmEjmGnb327+8PBj83XyIedVkswFerSA2plo02ye+juOxhSqCrKdWkQ==",
                "sha1": "3379b1a34916f52c890da833be7f1a95c5e8f19a"
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delivery-ci-core/MAL-2026-13540.json"