ded-aa-common-ded-aa-common-core

{"modified":"2026-08-05T15:17:13Z","published":"2026-08-05T15:17:13Z","schema_version":"1.7.4","id":"MAL-2026-13123","summary":"Malicious code in ded-aa-common-ded-aa-common-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94)\nOn require() of the package, index.js loads _ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101/cf102/cf103-*.workers.dev), writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_*.exe on Windows,.cache_* on Unix), chmods 0755, and spawns it detached via cmd.exe/start or /bin/sh -c with stdio ignored and unref(). C2 hostnames and fallback domains are assembled from split-and-join string arrays to evade static analysis (e.g. ['sd','k.d','l.w','el1.','ru'].join('')). If HTTPS retrieval fails, the code reassembles the payload from base64-encoded DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru) via dns.resolveTxt and Buffer.from(...,'base64'), providing a covert channel resilient to endpoint/firewall filtering. A marker file analytics_state/.analytics_state provides TTL suppression to hide repeated executions. No hash or signature verification of the fetched payload; the child_process module is imported inside the activation path to further hinder static analysis.\n","affected":[{"package":{"ecosystem":"npm","name":"ded-aa-common-ded-aa-common-core"},"versions":["35.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"e0e3057cab253fa8cac075494ff607ff2d6d0fadf5ef0356bd47683d3805f49d","tlsh":"11a1759a06aab0098fb0d7e4c7178816f65bf9533780c294f79c65885f7212483b2dfc"}],"package_integrity":[{"filename":"ded-aa-common-ded-aa-common-core-35.1.6.tgz","hashes":{"sha1":"3aa3e183b09a639c80954193b629dc69d1c75b40","sha512_sri":"sha512-fWGGsRHdIxzdNcHFXBjy60NzLAutXIfGvAg+7cPlQTcEmbX/X3p+T15NtUwPYH+NWFRBwM6coa1WnXYM3umyMA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-aa-common-ded-aa-common-core/v/35.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015638","import_time":"2026-08-05T15:20:01.199494341Z","modified_time":"2026-08-05T15:17:13Z","sha256":"30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94","source":"amazon-inspector","versions":["35.1.6"]}]}}