delivery-ci-upgrade-form

{"modified":"2026-08-05T13:54:29Z","published":"2026-08-05T13:54:29Z","schema_version":"1.7.4","id":"MAL-2026-12686","summary":"Malicious code in delivery-ci-upgrade-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce)\nindex.js unconditionally requires./_runtime at module load. _runtime.js detects platform/arch and downloads an OS-specific binary (linux_x64, linux_arm64, darwin, win32) from string-split-obfuscated Cloudflare Worker hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched payload is written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe. A.analytics_state stamp file TTL-gates re-execution. lib/telemetry.js ships a parallel dropper (HttpTransport/ServiceDiscovery/WorkerHost/NativeProfiler) with base64-decoded chunks written to disk, chmod'd 0755, spawned via cp.spawn('/bin/sh', ['-c', filePath+' &']), and obfuscates the child_process import as require('child_' + 'process'). Destination hostnames and dangerous API names are reassembled from split-string arrays to defeat static analysis.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-upgrade-form"},"versions":["35.5.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"b0064bf27410524127ef0a56dd370adf6faf386d498379e015459bacbf6aa0e4","tlsh":"11b1975a12a6701c4bb0ebe0c71b9825f65af6633781c290fb9c69945f7312883b1dfc"},{"path":"lib/telemetry.js","sha256":"7bb3edcc16b169691efaa91116840d860827ee7bb8125dd2ccf399c04c993ae0","tlsh":"cb835f55566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"delivery-ci-upgrade-form-35.5.9.tgz","hashes":{"sha1":"b984f30f682bcf0b3631cd75675d6790ff4c17d2","sha512_sri":"sha512-+Myx9rN6kspG4wFW8eBfB4GpFmhfHWpXfYOViy5be4+VqBBGDW/oA5v0ishaFfaT3sPE2wA60vXO0tPYEYqSKA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-upgrade-form/v/35.5.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015088","import_time":"2026-08-05T14:20:00.708802141Z","modified_time":"2026-08-05T13:54:29Z","sha256":"c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce","source":"amazon-inspector","versions":["35.5.9"]}]}}