MalwarePublished 5 Aug 2026

devplatform-spa-ui (npm) · Malicious Code

Affects devplatform-spa-uiSource GCVE Database

Malicious package : remove devplatform-spa-ui and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 22:02 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13262

What to do

Remove devplatform-spa-ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-spa-ui	Affected =35.8.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The devplatform-spa-ui npm package version 35.8.2 contains malicious code that downloads and executes a binary payload from external hosts. This behavior is hidden behind obfuscated runtime string assembly to evade detection. The payload is written to a temporary hidden path and executed detached from the main process. The malicious actions are unrelated to the package's advertised purpose as a SPA UI toolkit and lack any integrity verification of the downloaded binaries.

Impact

This malicious package can execute arbitrary code on the host system by downloading and running an external binary without user consent or verification. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and lack of integrity checks increase the risk of undetected exploitation. Since the payload is OS-specific and runs detached, it can persist and evade simple detection methods.

Defensive guidance

Users should immediately avoid using devplatform-spa-ui version 35.8.2 and remove it from their environments. Verify dependencies and source integrity before installation. Monitor for updates or advisories from the package publisher or npm registry. Consider using package integrity verification tools and restrict execution permissions for downloaded binaries.

Summary

The devplatform-spa-ui package version 35.8.2 includes a malicious component that, upon require, selects an OS-specific payload URL from rotating hosts and downloads a binary executable. This binary is saved to a hidden temporary file path with executable permissions and then spawned detached from the main process. The code uses runtime string concatenation to reconstruct sensitive API names and destination hostnames to evade static detection. The telemetry module duplicates this drop-and-execute behavior. There is no hash or signature verification of the downloaded payload, and the destinations are not affiliated with the package publisher. This behavior constitutes a supply chain compromise via a malicious npm package.

References

npmjs.com/package/devplatform-spa-ui/v/35.8.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 22:02 UTC

Technical details

References

Community reviews