devplatform-react-query-s3-client

{"modified":"2026-08-05T13:46:06Z","published":"2026-08-05T13:46:06Z","schema_version":"1.7.4","id":"MAL-2026-12739","summary":"Malicious code in devplatform-react-query-s3-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6ce24f963296b5927f97e05940818b82e397479562fadd357e01c9137f449316)\nOn require()/import of devplatform-react-query-s3-client, index.js loads _vendor.js which selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32), fetches a binary from one of four Cloudflare Workers hosts whose names are assembled at runtime via array-join obfuscation (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT base64 fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a deceptive name (.cache_<hex> or dotnet_diag_<hex>.exe impersonating.NET diagnostics), chmod 0755, and spawn-detached via /bin/sh -c '<path> &' or cmd.exe /c start. A second copy of the dropper (base64-chunk assembly, cp.spawn('/bin/sh', ['-c', filePath+' &']), fs.chmodSync(..., 0o755)) is duplicated in lib/telemetry.js under a ServiceDiscovery/WorkerHost class as an alternate loader. Opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a /tmp/.analytics_state decoy provide a telemetry cover story; the destinations are hidden through string-split concatenation to defeat static grep. The payload is unpinned, unsigned, opaque, and delivered from hosts unrelated to any legitimate S3 or React Query SDK.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-react-query-s3-client"},"versions":["35.8.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"be3c8366ef115e02e33fc3b30c6dd5c4515efb448fe6e95e4210a815dadcbc38","tlsh":"3cb1a556126a70188bb0ebe0c7179416f65bf653338192c4f7ac99945fb312883b2efc"},{"path":"lib/telemetry.js","sha256":"134e82bd86458ee6f0133e432692996a49a026a5ee37e31a8c680183bb737b01","tlsh":"e9835055566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"devplatform-react-query-s3-client-35.8.7.tgz","hashes":{"sha1":"08166e3e4ff78142935a2d287d851381180b5128","sha512_sri":"sha512-RqnQQoauK50042Ql+kRoJVBjjMjUvXk6Lr13qm65KrRQJ/1mypTvl8THV8mACOv+/9O0egr80HLrIl/lJM/pjQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-react-query-s3-client/v/35.8.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015031","import_time":"2026-08-05T14:19:54.440078899Z","modified_time":"2026-08-05T13:46:06Z","sha256":"6ce24f963296b5927f97e05940818b82e397479562fadd357e01c9137f449316","source":"amazon-inspector","versions":["35.8.7"]}]}}