Malicious code in devplatform-iam-client (npm)
The devplatform-iam-client npm package contains malicious code that executes automatically upon loading. It downloads an opaque binary from obfuscated Cloudflare Workers endpoints and DNS-TXT record fallbacks, writes it to a disguised temporary path, sets executable permissions, and runs it detached. This behavior enables full host code execution on the machine that installs or requires the package. The package appears to be a dependency confusion attack targeting internal registry names.
AI Analysis
Technical Summary
The devplatform-iam-client npm package exports a no-op client but unconditionally requires an _init.js script on load. This script dynamically reconstructs Cloudflare Workers endpoints and uses a DNS-TXT covert channel fallback to download a binary payload. The payload is saved to a disguised temporary file path with executable permissions and then executed detached via shell commands. No integrity checks such as hash or signature verification are performed. The package's naming and stub implementation suggest it is a malicious dependency confusion lure designed to achieve full code execution on the host at require() time.
Potential Impact
Successful installation or requiring of this package results in arbitrary code execution on the host system with the privileges of the user running the process. This can lead to complete compromise of the affected environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or requiring the devplatform-iam-client package version 35.5.6. Verify internal package sources and implement controls to prevent dependency confusion attacks. Monitor for and remove this package if found in any environment.
Malicious code in devplatform-iam-client (npm)
Description
The devplatform-iam-client npm package contains malicious code that executes automatically upon loading. It downloads an opaque binary from obfuscated Cloudflare Workers endpoints and DNS-TXT record fallbacks, writes it to a disguised temporary path, sets executable permissions, and runs it detached. This behavior enables full host code execution on the machine that installs or requires the package. The package appears to be a dependency confusion attack targeting internal registry names.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The devplatform-iam-client npm package exports a no-op client but unconditionally requires an _init.js script on load. This script dynamically reconstructs Cloudflare Workers endpoints and uses a DNS-TXT covert channel fallback to download a binary payload. The payload is saved to a disguised temporary file path with executable permissions and then executed detached via shell commands. No integrity checks such as hash or signature verification are performed. The package's naming and stub implementation suggest it is a malicious dependency confusion lure designed to achieve full code execution on the host at require() time.
Potential Impact
Successful installation or requiring of this package results in arbitrary code execution on the host system with the privileges of the user running the process. This can lead to complete compromise of the affected environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or requiring the devplatform-iam-client package version 35.5.6. Verify internal package sources and implement controls to prevent dependency confusion attacks. Monitor for and remove this package if found in any environment.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12715
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735738bf8831d53914a59d
Added to database: 08/05/2026, 15:31:04 UTC
Last enriched: 08/05/2026, 16:32:26 UTC
Last updated: 08/05/2026, 16:32:26 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.