devplatform-spa-plugin-module-loader

{"modified":"2026-08-05T13:42:02Z","published":"2026-08-05T13:42:02Z","schema_version":"1.7.4","id":"MAL-2026-12772","summary":"Malicious code in devplatform-spa-plugin-module-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8)\nOn require, index.js unconditionally loads _platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from subdomains of dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmod 0755, and detached-spawned via cp.spawn('/bin/sh', ['-c', fp+' &']) or the Windows equivalent. Destination hostnames and the child_process API name are assembled by joining split string fragments (e.g. ['sdk.','dl.wel1.','ru'].join('')); dropped-file names mimic legitimate cache/diagnostic paths; cover-story comments reference SHA-256 integrity checks and rate limiting with no matching code; an opt-out env var (DISABLE_TELEMETRY) frames the behavior as analytics. The workers.dev destinations are anonymous, mutable, and unrelated to any legitimate publisher of a module-loader package.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-spa-plugin-module-loader"},"versions":["35.8.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"d7fe9d04211e91353e5087cce670e0ac6ab70ab3aa4c7911d514177cf3fe5e62","tlsh":"2ca1879a116670188bb09be4c7275416f65ff6633380c2d4fb5ca9941fb612483b2efc"}],"package_integrity":[{"filename":"devplatform-spa-plugin-module-loader-35.8.5.tgz","hashes":{"sha1":"36a47528c269787c8a60a6ff17c449aa22904e22","sha512_sri":"sha512-302k8yU5cSfD2SFXNEi+ZJoII06DXnzX4ReOJ5LFf2gWs6yqcnKVexAoYoeHsChfB2Nj9PmJngWaGflhIXjzkA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-spa-plugin-module-loader/v/35.8.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015003","import_time":"2026-08-05T14:19:51.610496139Z","modified_time":"2026-08-05T13:42:02Z","sha256":"902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8","source":"amazon-inspector","versions":["35.8.5"]}]}}