MalwarePublished 5 Aug 2026Updated 20 Aug 2026

devplatform-spa-testing (npm) · Malicious Code

Affects devplatform-spa-testingSource GCVE Database

Malicious package : remove devplatform-spa-testing and rotate any secrets on hosts that installed it.

Data as of 20 Aug 2026, 16:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12784

What to do

Remove devplatform-spa-testing from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-spa-testing	Affected =35.8.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'devplatform-spa-testing' version 35.8.6 contains malicious code that, when imported, downloads and executes attacker-controlled payloads on the victim's machine. The payload is fetched from obfuscated command-and-control (C2) hostnames and executed with elevated permissions, potentially compromising the entire system. Removal of the package does not guarantee full remediation due to possible persistent malicious software installed during execution.

Impact

Any system that installs or runs this package is considered fully compromised. The attacker gains the ability to execute arbitrary code with the privileges of the user running the package. This can lead to theft of secrets, keys, and other sensitive information. Because the malicious payload is executed immediately and may install persistent backdoors, simply removing the package does not ensure complete remediation.

Defensive guidance

Immediate removal of the 'devplatform-spa-testing' package version 35.8.6 is recommended. All secrets and keys stored on the compromised machine should be rotated from a separate, trusted device. Due to the high likelihood of persistent compromise, a full system reinstallation or forensic analysis is advised to ensure complete eradication of malicious software.

Summary

The 'devplatform-spa-testing' npm package (version 35.8.6) includes malicious functionality in its index.js file. Upon requiring the package, it loads a platform-specific script that constructs obfuscated C2 hostnames to retrieve a payload over HTTPS. This payload is saved to temporary directories under disguised filenames and executed detached via shell commands. The obfuscation techniques include string concatenation of hostname fragments and misleading comments to evade detection. The attacker-controlled payload execution at import time results in full compromise of the host machine.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2026, 16:58 UTC

Technical details

References

Community reviews