devplatform-nx-pvm

{"modified":"2026-08-05T13:50:22Z","published":"2026-08-05T13:50:22Z","schema_version":"1.7.4","id":"MAL-2026-12725","summary":"Malicious code in devplatform-nx-pvm (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4)\nOn require() of devplatform-nx-pvm, _compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a disguised filename (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. The C2 hostnames are assembled from split string arrays (e.g. [\"oob-worker.cf100-416.work\",\"ers.dev\"].join(\"\")) to evade static scanners, and a cover file named analytics_state is used as a run marker. If the HTTPS fetches fail, the code falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru, retrieving a chunk count from c.<domain> and base64-encoded payload chunks from N.<domain>, concatenating and decoding them, then executing the resulting binary. The dropper is skipped when specific telemetry opt-out environment variables are set, further indicating stealth. The package presents itself as a trivial library shim, and index.js unconditionally requires _compat, so installing and importing the package auto-executes the attacker-controlled binary on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-nx-pvm"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"007c7d13a0f5157d7c163701b3e31b1750df56b0e134b203e55e1ae8b927b521","tlsh":"02a1a75a266a71184b70e7f1c717441af657f66333808288fb9c94981f7356483b2efc"}],"package_integrity":[{"filename":"devplatform-nx-pvm-35.2.9.tgz","hashes":{"sha1":"5a597f4dc9f474aec3fb8ed423262a4cc94b2060","sha512_sri":"sha512-fl39yOtoe7y0hbecY7h9jB3NOObTnMhkHT+rB4IP5rjuGIFFAAjonB1fFK7NwXpeZ1uTaXLIu+xkdVBsXP4Fzw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-nx-pvm/v/35.2.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015060","import_time":"2026-08-05T14:19:57.736293785Z","modified_time":"2026-08-05T13:50:22Z","sha256":"58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4","source":"amazon-inspector","versions":["35.2.9"]}]}}