MAL-2026-13545

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-errors/MAL-2026-13545.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13545
Published
2026-08-07T12:27:43Z
Modified
2026-08-07T13:20:24.521079236Z
Summary
Malicious code in devplatform-spa-errors (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59)

On require() of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary from string-concatenated Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback channel to *.dl.wel1.ru, writes the bytes to a temp path disguised as dotnetdiag<tok>.exe on Windows or.cache<tok> on POSIX, chmods it to 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. Hostnames and dropped filenames are assembled at runtime from split-string arrays and framed with Analytics/telemetry SDK cover strings. lib/telemetry.js contains a duplicate copy of the dropper logic (base64-decoded chunks, chmodSync 0755, cp.spawn('/bin/sh', ['-c', filePath + ' &'])) inside a decoy Sentry-like observability module. The package delivers attacker-controlled native code to the installer's host on module load, with no integrity verification and active string obfuscation to evade review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016990",
            "modified_time": "2026-08-07T12:27:43Z",
            "source": "amazon-inspector",
            "sha256": "5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59",
            "versions": [
                "35.5.7"
            ],
            "import_time": "2026-08-07T12:51:21.203019366Z"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-errors

Package

Name
devplatform-spa-errors
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-errors

Affected ranges

Affected versions

35.*
35.5.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-errors/MAL-2026-13545.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "b76a90f579d2b8dbd36ae4bfd6d7bb924db1798d",
                "sha512_sri": "sha512-RFQN1I4Jh8lkgUJsbxCCKAuYd7jDh7O5QZQPMT0xPemUoJnLq1Kd7mJyAe+EfkBg6ksc6e9hKz4sb5wi+6xNdg=="
            },
            "filename": "devplatform-spa-errors-35.5.7.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "cea196aa16a670198bb0d7e4c6175416f65bf6637380c194f75c95881fb322483b2efc",
            "sha256": "819346201a8c53d5f4ce4b42429c1d6aed5383d0479a609dd22ee298dee8a2db",
            "path": "_loader.js"
        },
        {
            "tlsh": "a4835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "fa6fe4797e55bc0ea87df70c172730f113102613b2f2d64935935aa4b7d77452",
            "path": "lib/telemetry.js"
        }
    ]
}