Malicious code in ded-ps-ded-ps-core (npm)
The npm package ded-ps-ded-ps-core version 35.9.1 contains malicious code that executes arbitrary native binaries on the host system upon requiring the package. It dynamically fetches a platform-specific native binary from Cloudflare Workers and uses DNS TXT record fallback channels to retrieve the payload. The binary is saved to temporary directories with filenames mimicking legitimate cache or .NET diagnostic files, then executed detached from the main process. The package also uses runtime string concatenation to evade static analysis. This behavior results in arbitrary attacker-controlled native code execution on the host.
AI Analysis
Technical Summary
The ded-ps-ded-ps-core npm package version 35.9.1 includes malicious functionality triggered on require(). It loads a script that selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts, whose domain names are dynamically constructed at runtime. If that fails, it falls back to a covert DNS TXT channel using base64-chunked subdomains of wel1.ru. The binary is saved to temporary directories with filenames designed to appear as hidden cache or .NET diagnostic artifacts, then its permissions are set to executable and it is spawned detached via shell commands. Additional code constructs sensitive API names at runtime to evade static detection. This results in arbitrary native code execution controlled by an attacker on the host machine.
Potential Impact
Successful execution of this package leads to arbitrary native code execution on the host system, enabling an attacker to run any code with the privileges of the user installing or requiring the package. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment and privileges.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package version. Users should immediately avoid installing or requiring ded-ps-ded-ps-core version 35.9.1. Remove any existing installations of this version from systems. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes spawned from temporary directories mimicking cache or diagnostic files. Check vendor or repository advisories for updates or removal notices.
Malicious code in ded-ps-ded-ps-core (npm)
Description
The npm package ded-ps-ded-ps-core version 35.9.1 contains malicious code that executes arbitrary native binaries on the host system upon requiring the package. It dynamically fetches a platform-specific native binary from Cloudflare Workers and uses DNS TXT record fallback channels to retrieve the payload. The binary is saved to temporary directories with filenames mimicking legitimate cache or .NET diagnostic files, then executed detached from the main process. The package also uses runtime string concatenation to evade static analysis. This behavior results in arbitrary attacker-controlled native code execution on the host.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ded-ps-ded-ps-core npm package version 35.9.1 includes malicious functionality triggered on require(). It loads a script that selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts, whose domain names are dynamically constructed at runtime. If that fails, it falls back to a covert DNS TXT channel using base64-chunked subdomains of wel1.ru. The binary is saved to temporary directories with filenames designed to appear as hidden cache or .NET diagnostic artifacts, then its permissions are set to executable and it is spawned detached via shell commands. Additional code constructs sensitive API names at runtime to evade static detection. This results in arbitrary native code execution controlled by an attacker on the host machine.
Potential Impact
Successful execution of this package leads to arbitrary native code execution on the host system, enabling an attacker to run any code with the privileges of the user installing or requiring the package. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment and privileges.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package version. Users should immediately avoid installing or requiring ded-ps-ded-ps-core version 35.9.1. Remove any existing installations of this version from systems. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes spawned from temporary directories mimicking cache or diagnostic files. Check vendor or repository advisories for updates or removal notices.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12673
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735736bf8831d53914463b
Added to database: 08/05/2026, 15:31:02 UTC
Last enriched: 08/05/2026, 16:23:05 UTC
Last updated: 08/05/2026, 16:23:05 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.