Malicious code in delivery-ci-storyshots (npm)
The npm package delivery-ci-storyshots version 35.3.6 contains malicious code that executes remote code on the host during installation or requiring. It downloads a binary payload from attacker-controlled Cloudflare Workers and fallback domains, writes it to a temporary location, sets executable permissions, and runs it without any signature or verification. The malicious code uses runtime string assembly to evade static detection and includes a secondary loader disguised as telemetry functionality. This results in full-host remote code execution with attacker-controlled payload delivery.
AI Analysis
Technical Summary
The delivery-ci-storyshots npm package version 35.3.6 includes a malicious module that unconditionally requires a platform-specific adapter which downloads an opaque binary payload over HTTPS from multiple attacker-controlled Cloudflare Workers endpoints and fallback DNS-TXT chunked base64 sources. The payload is saved to a temporary hidden file or executable, permissions are set to executable, and it is spawned detached via shell commands. The code dynamically reconstructs dangerous APIs like child_process and chmodSync to evade static analysis. A sibling telemetry module mirrors this dropper behavior under the guise of analytics. Installing or requiring this package leads to full remote code execution on the host with attacker-controlled payloads.
Potential Impact
Successful installation or requiring of this package results in full remote code execution on the host system, allowing an attacker to run arbitrary code with the privileges of the installer. The payload is downloaded from attacker-controlled infrastructure without any signature or publisher verification, enabling arbitrary malicious code execution and potential system compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official advisory is available, avoid installing or requiring the delivery-ci-storyshots package version 35.3.6. Use trusted package sources and verify package integrity before installation. Consider scanning existing environments for presence of this package and remove it if found.
Malicious code in delivery-ci-storyshots (npm)
Description
The npm package delivery-ci-storyshots version 35.3.6 contains malicious code that executes remote code on the host during installation or requiring. It downloads a binary payload from attacker-controlled Cloudflare Workers and fallback domains, writes it to a temporary location, sets executable permissions, and runs it without any signature or verification. The malicious code uses runtime string assembly to evade static detection and includes a secondary loader disguised as telemetry functionality. This results in full-host remote code execution with attacker-controlled payload delivery.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The delivery-ci-storyshots npm package version 35.3.6 includes a malicious module that unconditionally requires a platform-specific adapter which downloads an opaque binary payload over HTTPS from multiple attacker-controlled Cloudflare Workers endpoints and fallback DNS-TXT chunked base64 sources. The payload is saved to a temporary hidden file or executable, permissions are set to executable, and it is spawned detached via shell commands. The code dynamically reconstructs dangerous APIs like child_process and chmodSync to evade static analysis. A sibling telemetry module mirrors this dropper behavior under the guise of analytics. Installing or requiring this package leads to full remote code execution on the host with attacker-controlled payloads.
Potential Impact
Successful installation or requiring of this package results in full remote code execution on the host system, allowing an attacker to run arbitrary code with the privileges of the installer. The payload is downloaded from attacker-controlled infrastructure without any signature or publisher verification, enabling arbitrary malicious code execution and potential system compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official advisory is available, avoid installing or requiring the delivery-ci-storyshots package version 35.3.6. Use trusted package sources and verify package integrity before installation. Consider scanning existing environments for presence of this package and remove it if found.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12682
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735737bf8831d539145dfa
Added to database: 08/05/2026, 15:31:03 UTC
Last enriched: 08/05/2026, 16:25:58 UTC
Last updated: 09/07/2026, 22:25:31 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.