delivery-ci-tech-holder

{"modified":"2026-08-05T13:55:14Z","published":"2026-08-05T13:55:14Z","schema_version":"1.7.4","id":"MAL-2026-12683","summary":"Malicious code in delivery-ci-tech-holder (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b)\nOn require() of the package, index.js loads _support.js, which reconstructs hardcoded destinations from split string arrays (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT fallback via sdk.dl.wel1.ru), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored and unref(). No hash or signature verification is performed, the destination hosts are unrelated to the package publisher, filenames impersonate legitimate system components (dotnet_diag,.cache_), and the string-split reassembly and DNS-TXT fallback channel are designed to evade static inspection. The fetched bytes are executed with the installer's privileges.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-tech-holder"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"b4c8aed4a4d33ee68e8d8522f34dc038fb9965db50d0af0a91d65c0ad35ba0ef","tlsh":"e8b1c79a056670184bb09be4c71b4816f666e6633380c698fb9ca9881f77524c372efc"}],"package_integrity":[{"filename":"delivery-ci-tech-holder-35.3.4.tgz","hashes":{"sha1":"eaefcab0e340631ec44c6b92cd64bb91d29a16e2","sha512_sri":"sha512-sJ+Rv3kiKUU7ealrg1W+NkdyWijSf7CArkryHQHDQFx9UkRne3Q0Bz5FwzMeCqCUEGjfV7ZgOcRdoZbTeBAKXw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-tech-holder/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015093","import_time":"2026-08-05T14:20:01.200619242Z","modified_time":"2026-08-05T13:55:14Z","sha256":"63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b","source":"amazon-inspector","versions":["35.3.4"]}]}}