Malicious code in devplatform-spa-plugin-root-devtools (npm)
The npm package devplatform-spa-plugin-root-devtools version 35.5.6 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. The package uses covert DNS-TXT queries to reassemble a base64-encoded payload, which is then written to temporary directories and executed without integrity verification. The malicious payload is unrelated to the package's stated purpose and attempts to evade static analysis by dynamically constructing hostnames.
AI Analysis
Technical Summary
The devplatform-spa-plugin-root-devtools npm package version 35.5.6 includes code in index.js that side-loads a compatibility script (_compat.js) which downloads a platform-specific executable from obfuscated Cloudflare Workers domains. It uses a DNS-TXT covert channel fallback querying *.dl.wel1.ru domains to reconstruct base64-encoded payload chunks. The binary is saved to temporary directories with disguised filenames, permissions set to executable, and launched detached via shell commands. Despite a comment suggesting SHA-256 integrity verification, no actual verification is performed. The delivery infrastructure and payload have no relation to the package's declared functionality, indicating malicious intent.
Potential Impact
The malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to unauthorized code execution, system compromise, or persistence. The obfuscation and covert channel techniques complicate detection and analysis. No known exploits in the wild are reported yet.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or using devplatform-spa-plugin-root-devtools version 35.5.6. Investigate and remove any instances of this package from development and production environments. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.
Malicious code in devplatform-spa-plugin-root-devtools (npm)
Description
The npm package devplatform-spa-plugin-root-devtools version 35.5.6 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. The package uses covert DNS-TXT queries to reassemble a base64-encoded payload, which is then written to temporary directories and executed without integrity verification. The malicious payload is unrelated to the package's stated purpose and attempts to evade static analysis by dynamically constructing hostnames.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The devplatform-spa-plugin-root-devtools npm package version 35.5.6 includes code in index.js that side-loads a compatibility script (_compat.js) which downloads a platform-specific executable from obfuscated Cloudflare Workers domains. It uses a DNS-TXT covert channel fallback querying *.dl.wel1.ru domains to reconstruct base64-encoded payload chunks. The binary is saved to temporary directories with disguised filenames, permissions set to executable, and launched detached via shell commands. Despite a comment suggesting SHA-256 integrity verification, no actual verification is performed. The delivery infrastructure and payload have no relation to the package's declared functionality, indicating malicious intent.
Potential Impact
The malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to unauthorized code execution, system compromise, or persistence. The obfuscation and covert channel techniques complicate detection and analysis. No known exploits in the wild are reported yet.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or using devplatform-spa-plugin-root-devtools version 35.5.6. Investigate and remove any instances of this package from development and production environments. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12775
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a73573bbf8831d539152eef
Added to database: 08/05/2026, 15:31:07 UTC
Last enriched: 08/05/2026, 16:47:40 UTC
Last updated: 08/05/2026, 16:47:40 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.