devplatform-spa-feature-toggle

{"modified":"2026-08-05T13:45:09Z","published":"2026-08-05T13:45:09Z","schema_version":"1.7.4","id":"MAL-2026-12758","summary":"Malicious code in devplatform-spa-feature-toggle (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1)\nOn require() of the package, index.js loads _bridge.js, which selects a per-OS payload path, fetches an executable from a list of Cloudflare Workers hosts assembled via runtime string-splitting (e.g. [\"oob-worker.cf101-adf.workers\",\".de\",\"v\"].join(\"\")) with a DNS-TXT chunked-base64 fallback to hosts such as sdk.dl.wel1.ru, writes the payload to /var/tmp or %TEMP% under decoy names like.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored. Additional cover-story markers include a.analytics_state marker file and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env gates. The destination hosts are not the package's publisher infrastructure and the fetched bytes are opaque and executed without integrity verification.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-spa-feature-toggle"},"versions":["35.8.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"b9b6b83098b592a41dc4b6804c6fa321f07959bd1d7f9253ca4e2ce1b5fe3248","tlsh":"10a1979a05b670198b7097e4871b8816f65bf6633380c284fb6c65985f77128c3b2dfc"}],"package_integrity":[{"filename":"devplatform-spa-feature-toggle-35.8.4.tgz","hashes":{"sha1":"eae2bb03db9fc6a1f265c0c3d32e5f6fd29ac65a","sha512_sri":"sha512-DcAtHVCrv9TXTOM42tBc5YJuNM8hBiMfZYHGGKcx01a1MaaPZ9X4YDbIPMMlWnMuI+f5wsKVKCP/ZvEWk4l3Ww=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-spa-feature-toggle/v/35.8.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015025","import_time":"2026-08-05T14:19:53.880415159Z","modified_time":"2026-08-05T13:45:09Z","sha256":"50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1","source":"amazon-inspector","versions":["35.8.4"]}]}}