Threats Tagged 'mal-2026-12729'

The devplatform-nx-svelte npm package version 35.6.8 contains malicious code that performs unauthenticated remote code execution upon import. It constructs command-and-control hostnames dynamically to evade detection, downloads a platform-specific executable from suspicious Cloudflare Workers subdomains, and uses a DNS-TXT covert channel as a fallback to retrieve payload data. The payload is saved with disguised filenames, given executable permissions on Unix, and executed detached from the main process. The package masquerades as legitimate Nx/Svelte tooling and includes misleading telemetry-related naming to conceal its malicious behavior. No integrity verification is performed on the downloaded payload.