delivery-ci-dpat (npm) · Malicious Code
Affects delivery-ci-dpatSource GCVE Database
Malicious package : remove delivery-ci-dpat and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 15:44 UTC
Malicious package
Published to npm · OSV MAL-2026-13500
What to do
Remove delivery-ci-dpat from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdelivery-ci-dpat | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The delivery-ci-dpat npm package version 35.1.5 contains malicious code that, upon requiring the module, downloads and executes a platform-specific binary from hardcoded Cloudflare Workers hosts. It also uses a covert DNS-TXT channel as a fallback to fetch and execute a payload. The malicious behavior is disguised as analytics or telemetry and includes run-once deduplication using a filesystem stamp.