dwsai-dwsai-core

{"modified":"2026-08-05T15:08:10Z","published":"2026-08-05T15:08:10Z","schema_version":"1.7.4","id":"MAL-2026-13204","summary":"Malicious code in dwsai-dwsai-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4d9ec945df21e9ec2a52fc5dccf5b2d8f734c53aba8c9b6bd14f515c8e4a4fc8)\nOn require('dwsai-dwsai-core'), index.js loads _adapter.js which downloads a platform-specific binary from author-controlled Cloudflare Workers mirrors and writes it to /tmp/.cache_<rnd> on Linux/macOS or %TEMP%/dotnet_diag_<rnd>.exe on Windows (masquerading as the Microsoft dotnet diagnostic tool). The file is chmodded 0755 and spawned detached via /bin/sh -c or cmd.exe, with stdio ignored and unref(). The mirror hostnames are reassembled at runtime from split-string arrays (e.g. ['oob-worker.cf100-41','6.worke','rs.de','v'].join('')) rather than appearing as literals, and a DNS-TXT fallback channel fetches a base64 payload chunked across TXT records at c.*.dl.wel1.ru via dns.resolveTxt to bypass HTTPS egress filtering. No hash or signature verification is performed on the downloaded binary. Execution is gated behind DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks and a cache-stamp at /tmp/.analytics_state, framed as opt-out telemetry — the masquerade filenames, runtime-assembled destinations, DNS covert channel, and detached-spawn shape are inconsistent with legitimate telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"dwsai-dwsai-core"},"versions":["35.8.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"d6ba0059676b5664d033021786c7e73c45a7f6f608a4c2170fa1a8b3b2a855fd","tlsh":"1ba1965a167970198bb0d7e48a274416f55ef6633380c2d4fb5ca9984fb61248372efc"}],"package_integrity":[{"filename":"dwsai-dwsai-core-35.8.4.tgz","hashes":{"sha1":"08ef0e9125445236d97c9bd27ae52c724b538724","sha512_sri":"sha512-wcQXJsFLz86r1VqS/zJ0ZeMK+TxMRf3U9CPzGd9mpOBesq6bURDZ5t6n1IkAlo1QThjetoRjgl2FuAO08HE3sg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dwsai-dwsai-core/v/35.8.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015580","import_time":"2026-08-05T15:19:58.988871876Z","modified_time":"2026-08-05T15:08:10Z","sha256":"4d9ec945df21e9ec2a52fc5dccf5b2d8f734c53aba8c9b6bd14f515c8e4a4fc8","source":"amazon-inspector","versions":["35.8.4"]}]}}