MalwarePublished 5 Aug 2026

devplatform-zod-wip-api (npm) · Malicious Code

Affects devplatform-zod-wip-apiSource GCVE Database

Malicious package : remove devplatform-zod-wip-api and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 21:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13275

What to do

Remove devplatform-zod-wip-api from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-zod-wip-api	Affected =35.9.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The devplatform-zod-wip-api@35.9.3 npm package is a malicious typosquatting package that executes attacker-controlled native code upon import. It drops and runs a platform-specific native binary fetched from attacker-controlled servers without any integrity verification, using obfuscated DNS and file names to evade detection. The package re-executes roughly every six hours and includes multiple dropper implementations to maintain persistence and stealth.

Impact

Any system that installs or requires devplatform-zod-wip-api@35.9.3 will execute arbitrary attacker-controlled native code with the privileges of the user running the Node.js process. This can lead to full system compromise, persistence, data exfiltration, or further malware deployment. The lack of integrity checks on downloaded binaries increases risk. The malicious code runs immediately on import, making all dependent projects vulnerable if they mistakenly include this package.

Defensive guidance

The best mitigation is to avoid installing or requiring devplatform-zod-wip-api@35.9.3. Users should verify package authenticity before installation, prefer official and well-known packages, and remove any instances of this package from their environments. Monitoring for and blocking network connections to the identified C2 domains may help detect or prevent payload retrieval. Since this is a malicious typosquat package, remediation involves removal and avoiding its use rather than patching.

Summary

The devplatform-zod-wip-api package version 35.9.3 is a typosquatting malicious package targeting the zod ecosystem. Upon being required, it immediately executes code that reconstructs a command-and-control hostname from obfuscated string fragments and DNS TXT records, then downloads a native binary over HTTPS. This binary is saved to temporary OS-specific locations with disguised filenames, given executable permissions, and launched detached from the parent process. The package includes a marker file to limit re-execution frequency to about six hours. A secondary dropper in telemetry.js uses base64-encoded DNS TXT chunks to fetch and execute additional code. The use of obfuscation, masquerading filenames, and multiple execution paths indicates deliberate evasion and malicious intent. No signature or hash verification is performed on the downloaded binaries, allowing arbitrary native code execution on the host.

References

npmjs.com/package/devplatform-zod-wip-api/v/35.9.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 21:47 UTC

Technical details

References

Community reviews