MAL-2026-13546

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-feature-toggle/MAL-2026-13546.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13546
Published
2026-08-07T12:28:26Z
Modified
2026-08-07T13:20:24.932565619Z
Summary
Malicious code in devplatform-spa-plugin-feature-toggle (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa)

devplatform-spa-plugin-feature-toggle@35.7.4 executes attacker-controlled code on the installer's host at module import. The package's main entry loads support.js, which builds three hardcoded origins under .workers.dev (oob-worker.cf101/cf102/cf103-) by array-join concatenation to evade string scanning, with a DNS-TXT base64-chunked fallback under *.dl.wel1.ru. It downloads an OS-specific binary, writes it to /var/tmp/.cache<rnd> on Unix or %TEMP%/dotnetdiag<rnd>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Cover-story naming ("analyticsstate", "telemetry", "dotnetdiag") does not match the package's advertised feature-toggle purpose. A sibling file lib/telemetry.js contains a larger variant of the same drop-and-exec primitives framed as an "Analytics SDK", not currently reached from main. The destination origins are anonymous Cloudflare Workers and a DDNS-style host, not a publisher-owned domain, and the delivered payload is an opaque executable with no pinning or integrity check.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:28:26Z",
            "id": "IN-MAL-2026-016995",
            "import_time": "2026-08-07T12:51:21.408065853Z",
            "versions": [
                "35.7.4"
            ],
            "source": "amazon-inspector",
            "sha256": "2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa"
        }
    ]
}
References
Credits

Affected packages

npm / devplatform-spa-plugin-feature-toggle

Package

Name
devplatform-spa-plugin-feature-toggle
View open source insights on deps.dev
Purl
pkg:npm/devplatform-spa-plugin-feature-toggle

Affected ranges

Affected versions

35.*
35.7.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "devplatform-spa-plugin-feature-toggle-35.7.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-K8/4TZaMdTXiQjh+RlnpTTPuEzaUur5Az4NqixICz8/65EgbX3dQj5j/+3UwMyV2sf0mPGxuzge37dL/x4LKlg==",
                "sha1": "f4c6ad6d52dd53d83819573c051848362521e400"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "tlsh": "24a1a6aa16a630098bb0d7f4c717581af65be6633380c684fb5ca5984f7312483b1efc",
            "sha256": "19067328974c8a40505838d2746b1d6d18fd063aaeb4b2a53a93adcad9ecca90"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "9f835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "440793e89f4aebd66b138c3c4659b04e74312530fccfd88b211af081c6c67744"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-spa-plugin-feature-toggle/MAL-2026-13546.json"