Malicious code in devplatform-test-pvm-is-even (npm)
The npm package devplatform-test-pvm-is-even version 35.9.5 contains malicious code that executes upon requiring the package. It dynamically constructs hostnames to evade static detection, downloads a platform-specific binary from Cloudflare Workers hosts, writes it to a disguised path, sets executable permissions, and spawns the binary detached from the main process. This behavior results in arbitrary code execution on the machine installing the package. The package is falsely advertised as test fixtures/helpers and has no legitimate reason to perform these actions.
AI Analysis
Technical Summary
The devplatform-test-pvm-is-even npm package (version 35.9.5) includes a malicious dropper in its main entry point (index.js). When required, it loads a runtime script that assembles obfuscated hostnames to fetch a native binary over HTTPS from Cloudflare Workers domains, with a DNS-TXT fallback. The binary is saved to a masqueraded file path with executable permissions and executed detached from the main process using shell commands. A TTL marker prevents repeated execution. This results in arbitrary code execution on the installer's machine without user interaction beyond requiring the package. The package's advertised purpose as test fixtures/helpers does not justify this behavior, indicating malicious intent.
Potential Impact
Arbitrary code execution on the system of any user who installs and requires this package version. This can lead to full compromise of the affected machine, unauthorized persistence, and potential further malicious activity. The execution occurs silently upon requiring the package, increasing risk of unnoticed compromise.
Mitigation Recommendations
No official patch or fix is currently available for this malicious package version. Users should immediately avoid installing or requiring devplatform-test-pvm-is-even version 35.9.5. Remove any installations of this package from systems. Use trusted sources and verify package integrity before installation. Monitor for suspicious activity related to this package. Check vendor or repository advisories for updates or removals.
Malicious code in devplatform-test-pvm-is-even (npm)
Description
The npm package devplatform-test-pvm-is-even version 35.9.5 contains malicious code that executes upon requiring the package. It dynamically constructs hostnames to evade static detection, downloads a platform-specific binary from Cloudflare Workers hosts, writes it to a disguised path, sets executable permissions, and spawns the binary detached from the main process. This behavior results in arbitrary code execution on the machine installing the package. The package is falsely advertised as test fixtures/helpers and has no legitimate reason to perform these actions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The devplatform-test-pvm-is-even npm package (version 35.9.5) includes a malicious dropper in its main entry point (index.js). When required, it loads a runtime script that assembles obfuscated hostnames to fetch a native binary over HTTPS from Cloudflare Workers domains, with a DNS-TXT fallback. The binary is saved to a masqueraded file path with executable permissions and executed detached from the main process using shell commands. A TTL marker prevents repeated execution. This results in arbitrary code execution on the installer's machine without user interaction beyond requiring the package. The package's advertised purpose as test fixtures/helpers does not justify this behavior, indicating malicious intent.
Potential Impact
Arbitrary code execution on the system of any user who installs and requires this package version. This can lead to full compromise of the affected machine, unauthorized persistence, and potential further malicious activity. The execution occurs silently upon requiring the package, increasing risk of unnoticed compromise.
Mitigation Recommendations
No official patch or fix is currently available for this malicious package version. Users should immediately avoid installing or requiring devplatform-test-pvm-is-even version 35.9.5. Remove any installations of this package from systems. Use trusted sources and verify package integrity before installation. Monitor for suspicious activity related to this package. Check vendor or repository advisories for updates or removals.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13267
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a73852cbf8831d5394f04c3
Added to database: 08/05/2026, 18:47:08 UTC
Last enriched: 08/05/2026, 22:03:12 UTC
Last updated: 08/05/2026, 22:03:12 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.