devplatform-react-scripts

{"modified":"2026-08-05T13:47:26Z","published":"2026-08-05T13:47:26Z","schema_version":"1.7.4","id":"MAL-2026-12741","summary":"Malicious code in devplatform-react-scripts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa)\nThe package's index.js requires./_init on load. _init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru, fetches a platform-specific binary over HTTPS, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. A.analytics_state marker file and env-var opt-out names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide telemetry cover. The advertised 'react-scripts adapter' purpose does not match the dropped-and-executed opaque binary. Any consumer that installs and requires this package receives arbitrary attacker code execution on their machine.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-react-scripts"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"aebf88c64140d18b6b8e64a18f1e0bf4a7ffe765cfe30887724cbcc0f2d91268","tlsh":"ffa1b89a067670084bb097e48717581af65bf66337c0c688fb5ca5981f7712483b2efc"}],"package_integrity":[{"filename":"devplatform-react-scripts-35.2.9.tgz","hashes":{"sha1":"dde198481ba772f1adc32ffe22eaada77b10d931","sha512_sri":"sha512-dqpt00LfIHzKZf82XpN1QBJrIgLLFbhfhfu8iIWKkwFRJPiJL5iurMHQJGjOuu+gvUkDmvIlhd0g2tBrIydf9Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-react-scripts/v/35.2.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015040","import_time":"2026-08-05T14:19:55.513459922Z","modified_time":"2026-08-05T13:47:26Z","sha256":"b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa","source":"amazon-inspector","versions":["35.2.9"]}]}}