devplatform-prettier-config

{"modified":"2026-08-05T13:46:43Z","published":"2026-08-05T13:46:43Z","schema_version":"1.7.4","id":"MAL-2026-12734","summary":"Malicious code in devplatform-prettier-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d)\nPackage presents itself as a prettier configuration/settings manager. index.js requires _compat.js at module load, which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) assembled at runtime from string-split arrays via.join(''). If the HTTPS fetch fails, it falls back to a covert DNS TXT-record channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (c.<domain> for chunk count, i.<domain> for base64-chunked payload), reassembles and executes the payload. The fetched bytes are written to /var/tmp/.cache_<rand> on Linux or TEMP\\dotnet_diag_<rand>.exe on Windows using deceptive filenames, chmod 0755, then spawned detached via spawn(\"/bin/sh\", [\"-c\",...]) or spawn(\"cmd\",...). No hash or signature verification. A lock-file at /tmp/.analytics_state is used to suppress repeated runs. Destinations are unrelated to any prettier or JavaScript-tooling publisher.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-prettier-config"},"versions":["35.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"de9da99c6464b15379f6c0931176fdfbb8f1918205ea14a419d2c4f6924f384d","tlsh":"86a1965a12a6301987b09be4cb175415f65af6633780c2d4fb9ca9985f7312482b3efc"}],"package_integrity":[{"filename":"devplatform-prettier-config-35.1.3.tgz","hashes":{"sha1":"07f01e79de91d6b3d20c7b547ddabe33cdf1a055","sha512_sri":"sha512-3/cxY9H1I3n5v/+XOM4tBt7Sqx2pHB7D322S+z91IO+dgYgury54MNsxQ0UCuGZZ7jUAL0kq1jDIvuQIQxS6WA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-prettier-config/v/35.1.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015035","import_time":"2026-08-05T14:19:54.970129569Z","modified_time":"2026-08-05T13:46:43Z","sha256":"db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d","source":"amazon-inspector","versions":["35.1.3"]}]}}