Threats Tagged 'mal-2026-12688'

The npm package delivery-ci-validate version 35.1.4 contains malicious code that executes automatically when the package is imported or required. It loads a polyfill script that dynamically constructs obfuscated hostnames to fetch attacker-controlled binaries from Cloudflare Workers URLs without version pinning or integrity checks. If that fails, it uses a covert DNS-TXT channel to retrieve a base64-encoded payload. The payload is saved to a temporary directory, made executable, and then executed detached via shell commands. This behavior is inconsistent with legitimate package functionality and represents a supply chain compromise.