MalwarePublished 5 Aug 2026

devplatform-utils (npm) · Malicious Code

Affects devplatform-utilsSource GCVE Database

Malicious package : remove devplatform-utils and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 21:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13271

What to do

Remove devplatform-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-utils	Affected =35.5.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The devplatform-utils npm package version 35.5.2 contains malicious code that downloads and executes a platform-specific binary payload from obfuscated Cloudflare Workers endpoints and fallback DNS-TXT records. The payload is saved to temporary directories with misleading filenames, given execute permissions, and launched detached from the main process. This behavior creates a persistent, operator-controlled code delivery channel triggered on each require() call, without verifying the integrity of the fetched binary. Environment variables related to telemetry opt-out are checked to disguise the malicious activity.

Impact

This malicious package enables an attacker to remotely deliver and execute arbitrary binary code on the host system where devplatform-utils@35.5.2 is installed. The persistence mechanism ensures repeated execution of the malicious payload, potentially leading to full system compromise or further malicious activity. The lack of integrity checks on the downloaded payload increases the risk of undetected compromise. Because the payload is executed detached and uses obfuscated network endpoints, detection and mitigation may be challenging.

Defensive guidance

Users should immediately remove or avoid using this package version. Investigate and clean any systems where this package was installed to detect and remove the malicious payloads. Monitor for suspicious processes spawned from temporary directories with names like dotnet_diag_* or .cache_*. Since no integrity verification is performed on the payload, do not trust binaries downloaded by this package. Check for updates or advisories from the package maintainers or npm registry for any forthcoming fixes.

Summary

The devplatform-utils package at version 35.5.2 includes an index.js module that requires a _bootstrap.js script. This script downloads a binary payload from obfuscated Cloudflare Workers endpoints (e.g., oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback via *.dl.wel1.ru. The payload is stored in temporary directories (/var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), given execute permissions (chmod 0755), and executed detached via shell commands. Hostnames for the payload download are assembled at runtime using fragmented string arrays to evade static detection. A rate-limit token stored in /tmp/.analytics_state enforces a ~5.9-hour expiration, causing the binary to be re-fetched and re-executed on subsequent require() calls, thus maintaining persistence. The code checks environment variables DISABLE_TELEMETRY and DO_NOT_TRACK to mimic legitimate telemetry opt-out behavior. No hash or signature verification is performed on the downloaded binary, allowing arbitrary code execution controlled by the attacker.

References

npmjs.com/package/devplatform-utils/v/35.5.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 21:48 UTC

Technical details

References

Community reviews