Malicious code in devplatform-spa (npm)
The devplatform-spa npm package version 35.1.4 contains malicious code that downloads and executes OS-specific binaries from Cloudflare Workers endpoints and fallback domains. This code writes the binaries to temporary directories under disguised filenames, sets executable permissions, and runs them detached from the main process. The malicious loader is invoked unconditionally on every require call, masquerading as telemetry with opt-out checks and no-op logging stubs.
AI Analysis
Technical Summary
The devplatform-spa package (version 35.1.4) includes a malicious loader (_loader.js) that downloads OS-specific binaries from dynamically constructed Cloudflare Workers hostnames and fallback DNS TXT-record channels. These binaries are saved to temporary directories with disguised names, permissioned for execution, and spawned detached via shell commands. The loader is invoked unconditionally from index.js, ensuring execution on every require. The package attempts to disguise this behavior as telemetry by including opt-out environment variable checks and no-op logging functions.
Potential Impact
The malicious code results in arbitrary code execution on the host system whenever the devplatform-spa package is required. This can lead to unauthorized actions, persistence, and potential compromise of the affected system. The execution of downloaded binaries without user consent or awareness poses a significant security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately stop using devplatform-spa version 35.1.4 and remove it from their environments. Verify dependencies and replace with trusted packages. Monitor for any unexpected binaries or processes spawned from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in devplatform-spa (npm)
Description
The devplatform-spa npm package version 35.1.4 contains malicious code that downloads and executes OS-specific binaries from Cloudflare Workers endpoints and fallback domains. This code writes the binaries to temporary directories under disguised filenames, sets executable permissions, and runs them detached from the main process. The malicious loader is invoked unconditionally on every require call, masquerading as telemetry with opt-out checks and no-op logging stubs.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The devplatform-spa package (version 35.1.4) includes a malicious loader (_loader.js) that downloads OS-specific binaries from dynamically constructed Cloudflare Workers hostnames and fallback DNS TXT-record channels. These binaries are saved to temporary directories with disguised names, permissioned for execution, and spawned detached via shell commands. The loader is invoked unconditionally from index.js, ensuring execution on every require. The package attempts to disguise this behavior as telemetry by including opt-out environment variable checks and no-op logging functions.
Potential Impact
The malicious code results in arbitrary code execution on the host system whenever the devplatform-spa package is required. This can lead to unauthorized actions, persistence, and potential compromise of the affected system. The execution of downloaded binaries without user consent or awareness poses a significant security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately stop using devplatform-spa version 35.1.4 and remove it from their environments. Verify dependencies and replace with trusted packages. Monitor for any unexpected binaries or processes spawned from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12754
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735739bf8831d53914f81b
Added to database: 08/05/2026, 15:31:05 UTC
Last enriched: 08/05/2026, 16:40:50 UTC
Last updated: 08/05/2026, 16:40:50 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.