MalwarePublished 5 Aug 2026

devplatform-test-pvm-is-odd (npm) · Malicious Code

Affects devplatform-test-pvm-is-oddSource GCVE Database

Malicious package : remove devplatform-test-pvm-is-odd and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 21:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13268

What to do

Remove devplatform-test-pvm-is-odd from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-test-pvm-is-odd	Affected =35.3.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package devplatform-test-pvm-is-odd version 35.3.9 contains malicious code that downloads and executes a platform-specific binary from anonymous external hosts. The package uses obfuscation techniques to evade static detection, including runtime string assembly for hostnames and sensitive function calls. The downloaded binary is saved to a disguised temporary path, given executable permissions, and executed detached from the main process. A second similar dropper is present but not invoked in this version. No integrity checks are performed on the downloaded payload, increasing risk.

Impact

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The obfuscation and lack of integrity checks increase the risk of undetected malicious payload execution. The presence of detached execution means the malicious process can persist independently of the npm package lifecycle.

Defensive guidance

Users should immediately remove devplatform-test-pvm-is-odd@35.3.9 from their environments and avoid installing this package. Employing supply chain security measures such as verifying package provenance and using trusted registries is recommended. Monitor for any unexpected binaries or processes spawned from npm packages.

Summary

The devplatform-test-pvm-is-odd@35.3.9 npm package is a lure package embedding malicious code in its index.js and lib/telemetry.js files. On load, it requires a bootstrap script that downloads a platform-specific binary from hardcoded Cloudflare Workers domains with a DNS-over-TXT fallback to an unrelated Russian domain. The binary is saved to a disguised temporary location, permissions are set to executable, and it is spawned detached via shell commands. The code employs runtime string concatenation to obfuscate hostnames and function calls such as 'child_process' and 'chmodSync' to evade static scanners. The telemetry.js dropper is structurally identical but not reachable in this version. No hash or signature verification is performed on the downloaded binaries, and the external hosts are unrelated to the package's documented purpose, indicating malicious intent.

References

npmjs.com/package/devplatform-test-pvm-is-odd/v/35.3.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 21:48 UTC

Technical details

References

Community reviews