MalwarePublished 5 Aug 2026

devplatform-spa-plugin-s3 (npm) · Malicious Code

Affects devplatform-spa-plugin-s3Source GCVE Database

Malicious package : remove devplatform-spa-plugin-s3 and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 22:02 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13260

What to do

Remove devplatform-spa-plugin-s3 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-spa-plugin-s3	Affected =35.5.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package devplatform-spa-plugin-s3 version 35.5.9 contains malicious code that acts as a binary dropper. When required, it fetches a platform-specific binary from suspicious external hosts, writes it to temporary directories under disguised names, sets executable permissions, and executes it detached from the main process. The package uses obfuscation techniques to evade static detection, including dynamic string assembly and covert payload delivery via DNS TXT records. The execution triggers on any require() call of the package, posing a risk of unauthorized code execution.

Impact

This malicious package enables remote code execution on any system that installs and requires devplatform-spa-plugin-s3 version 35.5.9. The attacker can execute arbitrary binaries downloaded from attacker-controlled infrastructure, potentially leading to full system compromise. The use of obfuscation and covert DNS channels complicates detection and forensic analysis. There is no indication of a legitimate fix or patch, and the package is effectively a supply chain threat.

Defensive guidance

Users should immediately remove devplatform-spa-plugin-s3 version 35.5.9 from their projects and dependency trees. Avoid installing or requiring this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected binaries or processes spawned from temporary directories. Consider scanning existing environments for presence of this package and any related dropped binaries. Report the package to npm security teams for takedown and further investigation.

Summary

The devplatform-spa-plugin-s3 npm package at version 35.5.9 includes a malicious binary dropper. Its index.js requires a shim module that downloads a binary from multiple suspicious worker.dev domains, writes it to temporary filesystem locations with disguised filenames, sets executable permissions, and spawns it detached from the parent process. Additionally, a fallback covert channel reconstructs the payload from base64-encoded DNS TXT records under the dl.wel1.ru domain. The package uses obfuscation such as split-string requires and computed method names to evade static analysis. The payload is unverified and unrelated to any legitimate S3 or SPA plugin publisher. This malicious behavior activates immediately upon requiring the package.

References

npmjs.com/package/devplatform-spa-plugin-s3/v/35.5.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 22:02 UTC

Technical details

References

Community reviews