devplatform-cli-plugin-test

{"modified":"2026-08-05T13:52:24Z","published":"2026-08-05T13:52:24Z","schema_version":"1.7.4","id":"MAL-2026-12703","summary":"Malicious code in devplatform-cli-plugin-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (307cdf72132de0cbce8bbbe7fd65b7c89d9c879fd917ff6a9e06e41ff56d299e)\nOn require(), _runtime.js selects a platform-specific asset, downloads a binary over https.get from hardcoded Cloudflare Workers hosts (with a DNS TXT base64 fallback under dl.wel1.ru), writes it to /var/tmp or %TEMP% under names mimicking diagnostic tools (dotnet_diag_*.exe,.cache_*,.analytics_state), chmods it 0o755, and spawns it detached via spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or cmd.exe /c start /b. C2 hostnames and fallback domains are reconstructed at runtime from split-string arrays to evade static scanners. No hash or signature verification. The destinations are non-publisher, mutable, and disguised, and the package advertises itself as test fixtures while performing this drop-and-execute on load.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-cli-plugin-test"},"versions":["35.4.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"90c78d6b9234cb9f9be129b84dcc59e2bac4c231b5fd571b5eb0df97603b0274","tlsh":"08a1755a166a71198b70ebe4c7174415f65af6633381c184f7aca8885fb3124c3b2efc"}],"package_integrity":[{"filename":"devplatform-cli-plugin-test-35.4.5.tgz","hashes":{"sha1":"a47f3db94e35ed52519fbc2b3e5bafc90ab300d1","sha512_sri":"sha512-NQXJpfJ4VrdQZUtWDdgy3s9CV8GILC4FGAVWih9pYXmJ3RujMGqD0zjR8vbPrUd1d3UQxXan84kLQaOZCBnnKA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-cli-plugin-test/v/35.4.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015074","import_time":"2026-08-05T14:19:59.224309242Z","modified_time":"2026-08-05T13:52:24Z","sha256":"307cdf72132de0cbce8bbbe7fd65b7c89d9c879fd917ff6a9e06e41ff56d299e","source":"amazon-inspector","versions":["35.4.5"]}]}}