delivery-ci-validate

{"modified":"2026-08-05T13:55:07Z","published":"2026-08-05T13:55:07Z","schema_version":"1.7.4","id":"MAL-2026-12688","summary":"Malicious code in delivery-ci-validate (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490)\nRequiring delivery-ci-validate loads _polyfill.js, which assembles destination hostnames from split string fragments joined at runtime (e.g. 'oob-'+'worker.cf100-416.workers.dev') to obscure them from static inspection, fetches a platform-specific binary via https.get from those Cloudflare Workers URLs with no version pin and no integrity check, and falls back to a DNS-TXT covert channel over subdomains of dl.wel1.ru that pulls chunked base64-encoded payload bytes. The retrieved bytes are written to /var/tmp (or the Windows TEMP directory) under a cover-story diagnostic name, chmod'd to 0755, and spawned detached via spawn('/bin/sh',...) or spawn('cmd',...). The entry point index.js requires _polyfill.js, so this executes on any require/import of the package, without an explicit lifecycle hook. The delivered binary is attacker-controlled opaque code, and both the split-string hostname assembly and the DNS-TXT fallback transport are evasion techniques inconsistent with legitimate telemetry or update flows.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-validate"},"versions":["35.1.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"075db9feeae9593f650203e2f288db5245db7fb826a0e8e42b55d3c688ce73cf","tlsh":"04b1869a166a71188bb0dbe4c71b5416f55af66333c0c194fb9c69941fb3124c2b1dfc"}],"package_integrity":[{"filename":"delivery-ci-validate-35.1.4.tgz","hashes":{"sha1":"215ed4112710e9d964b7b9f26f7a256df7fb78e9","sha512_sri":"sha512-7etFPPNbw688M9PE8iqbjzNYnS55Rt7tJzkzfSf+gJWjjKmXpc/7hLBqvYGwmLp6GNUyKBPXUOPcL+Y3Px/toQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-validate/v/35.1.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015092","import_time":"2026-08-05T14:20:01.096087533Z","modified_time":"2026-08-05T13:55:07Z","sha256":"95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490","source":"amazon-inspector","versions":["35.1.4"]}]}}