devplatform-spa-plugin-analytics (npm) · Malicious Code
Affects devplatform-spa-plugin-analyticsSource GCVE Database
Malicious package : remove devplatform-spa-plugin-analytics and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 16:40 UTC
Malicious package
Published to npm · OSV MAL-2026-12760
What to do
Remove devplatform-spa-plugin-analytics from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdevplatform-spa-plugin-analytics | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package devplatform-spa-plugin-analytics version 35.5.7 contains malicious code that executes automatically upon requiring the package. It downloads a platform-specific executable from obfuscated Cloudflare Workers domains, writes it to a temporary directory under a hidden name, sets executable permissions, and runs it detached. The package uses DNS-TXT records as a covert fallback channel to deliver the malicious binary. This behavior results in full-host code execution on the system installing the package.