Malicious code in devplatform-api-endpoint (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a79a64efe72b14455f83f667581664c2369f92f669983a58cede299f70bcadc) On require() of the package's main entry, index.js unconditionally loads _bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers hosts whose names are constructed by concatenating fragmented string literals (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The downloaded bytes are written to a temp path with a masquerading filename (dotnet_diag_*.exe,.cache_*), chmod 0755'd, and spawned detached via child_process (/bin/sh -c or cmd.exe /c start). A DNS-TXT covert-channel fallback resolves TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) enumerated as c.<domain>, 0.<domain>, 1.<domain>,... and base64-decodes the concatenated TXT payloads into an executable that is then written and run. Endpoint literals are fragmented (e.g., ["oob-worker.cf101-","ad","f.workers.d","ev"].join("")) purely to evade static matching. The package advertises no purpose that justifies fetching and executing remote binaries.
Malicious code in devplatform-api-endpoint (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a79a64efe72b14455f83f667581664c2369f92f669983a58cede299f70bcadc) On require() of the package's main entry, index.js unconditionally loads _bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers hosts whose names are constructed by concatenating fragmented string literals (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The downloaded bytes are written to a temp path with a masquerading filename (dotnet_diag_*.exe,.cache_*), chmod 0755'd, and spawned detached via child_process (/bin/sh -c or cmd.exe /c start). A DNS-TXT covert-channel fallback resolves TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) enumerated as c.<domain>, 0.<domain>, 1.<domain>,... and base64-decodes the concatenated TXT payloads into an executable that is then written and run. Endpoint literals are fragmented (e.g., ["oob-worker.cf101-","ad","f.workers.d","ev"].join("")) purely to evade static matching. The package advertises no purpose that justifies fetching and executing remote binaries.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12692
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735737bf8831d539146ff8
Added to database: 08/05/2026, 15:31:03 UTC
Last updated: 08/05/2026, 15:31:03 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.