MalwarePublished 7 Aug 2026

ded-pwa-c-mapping (npm) · Malicious Code

Affects ded-pwa-c-mappingSource GCVE Database

Malicious package : remove ded-pwa-c-mapping and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13535

What to do

Remove ded-pwa-c-mapping from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmded-pwa-c-mapping	Affected =35.8.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ded-pwa-c-mapping version 35.8.7 contains malicious code that, upon requiring the package, executes a bootstrap routine to download and run a native binary payload from dynamically assembled, obfuscated external hosts. The payload is saved under disguised filenames in temporary directories, given executable permissions, and launched detached from the installing process without any integrity verification. The code attempts to evade detection by assembling hostnames at runtime and referencing environment variables to frame the behavior as telemetry. No official patch or remediation guidance is provided.

Impact

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, persistence, or further malware deployment. The lack of payload integrity checks and obfuscation techniques increase the risk of undetected exploitation. Since the payload runs detached from the installing process, it can evade some detection mechanisms. No known exploits in the wild have been reported yet.

Defensive guidance

Users should immediately remove the affected version (=35.8.7) of the ded-pwa-c-mapping package from their environments. Avoid installing or requiring this package version. Monitor for any unusual processes spawned from temporary directories with disguised names. Consider using package integrity verification tools and restrict network access to suspicious external hosts. Check vendor advisories or trusted security sources for updates or fixes.

Summary

The ded-pwa-c-mapping npm package version 35.8.7 includes a malicious helper script (_helpers.js) that, when the package is required, selects a platform-specific native binary payload fetched over HTTPS from obfuscated workers.dev and dl.wel1.ru domains. The payload is downloaded without hash or signature verification, saved under disguised names in temporary directories (/var/tmp or %TEMP%), permissioned as executable, and spawned detached via shell commands. Hostnames are constructed at runtime by joining fragments to evade string-based detection, and a marker file is used to throttle repeated execution. The code references opt-out environment variables to masquerade as telemetry collection. This behavior constitutes a supply chain compromise through a malicious package.

References

npmjs.com/package/ded-pwa-c-mapping/v/35.8.7 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:29 UTC

Technical details

References

Community reviews