devplatform-rest-resources-v2

{"modified":"2026-08-05T13:44:53Z","published":"2026-08-05T13:44:53Z","schema_version":"1.7.4","id":"MAL-2026-12746","summary":"Malicious code in devplatform-rest-resources-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316)\nOn require of devplatform-rest-resources-v2, index.js loads _adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime by joining split string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS TXT fallback resolving base64 payload locations from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as.cache_<hex> on POSIX and dotnet_diag_<hex>.exe on Windows, chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. A sibling lib/telemetry.js contains a second base64->write->chmod->spawn dropper skeleton. The hosts, filenames, and execution path are unrelated to any declared REST-resources purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-rest-resources-v2"},"versions":["35.9.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"184bf8259b9952fd65674095a5fc2ca3a0eefb7af3c3586c6e27e322e89db017","tlsh":"d7a1b69a16a6301d8bb09be0cb175416f65bf6633781c294fb6ca5841f7212483b2efc"}],"package_integrity":[{"filename":"devplatform-rest-resources-v2-35.9.7.tgz","hashes":{"sha1":"36811cfff913c90fa90432ff6437ad24c0ca1461","sha512_sri":"sha512-aVlfOZMJk6mfm46LEw0vUF4Afpw9xiW/hJsZHJCRnxFC9rsjIYqFSDb5mkKwgoEt2o5JvXqp7s88gPhecFxxXw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-rest-resources-v2/v/35.9.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015023","import_time":"2026-08-05T14:19:53.64700563Z","modified_time":"2026-08-05T13:44:53Z","sha256":"51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316","source":"amazon-inspector","versions":["35.9.7"]}]}}