devplatform-markdown

{"modified":"2026-08-05T13:50:29Z","published":"2026-08-05T13:50:29Z","schema_version":"1.7.4","id":"MAL-2026-12720","summary":"Malicious code in devplatform-markdown (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4)\ndevplatform-markdown@35.9.6 advertises itself as a markdown provider but on require of index.js loads _adapter.js, which fetches a platform-specific binary from obfuscated Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback under *.dl.wel1.ru. Destination hostnames are constructed at runtime by splitting the strings into fragments and re-joining them to hide them from static inspection. The downloaded bytes are written under disguised names (e.g..cache_<hex>, dotnet_diag_<hex>.exe) in /var/tmp or the Windows Temp directory, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. A local marker file named.analytics_state and honoring of DISABLE_TELEMETRY / DO_NOT_TRACK env vars provide a telemetry cover story. Any process that requires this package executes an attacker-supplied binary on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-markdown"},"versions":["35.9.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"8302819626f7c7f339a08d02af30cb2a962826f8579d6cf593841f2d4d03de4e","tlsh":"bca1969a156a70198bb09be48717541af65bf6633380c2c4fb6c58841f7716483b2dfc"}],"package_integrity":[{"filename":"devplatform-markdown-35.9.6.tgz","hashes":{"sha1":"37d9673eab25cdae30a282c0cdae5ba93f11f57d","sha512_sri":"sha512-gW3+9t2v01cfLj9kQIrT3zXoeqO3E0YmcZCxpjNaQ0Fy/mJrdn3+ad5o7xqerkcX4/gSxbEoj4wshhbRbHKqkg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-markdown/v/35.9.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015061","import_time":"2026-08-05T14:19:57.843022292Z","modified_time":"2026-08-05T13:50:29Z","sha256":"9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4","source":"amazon-inspector","versions":["35.9.6"]}]}}