devplatform-spa-ui

{"modified":"2026-08-05T15:31:21Z","published":"2026-08-05T15:31:21Z","schema_version":"1.7.4","id":"MAL-2026-13262","summary":"Malicious code in devplatform-spa-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428)\nOn require, `_vendor.js` selects a per-OS payload URL, fetches a binary from rotating `*.workers.dev` hosts (with a DNS-TXT base64 fallback via `*.dl.wel1.ru`), writes it to a hidden temp path (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` or the Windows equivalent. Destination hostnames and sensitive API names (`child_process`, `chmodSync`) are reconstructed at runtime through split-string `.join('')` concatenation to evade scanners. `lib/telemetry.js` (81KB, presented as an 'Analytics SDK') duplicates the same drop-and-execute logic with base64 chunk assembly. No hash or signature verification; destinations are not the publisher; behavior is unrelated to the advertised SPA UI toolkit purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"devplatform-spa-ui"},"versions":["35.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"4357a7c2b9f73dcd8905d1f1299487fc91653a4fca1402ad106cad4709dc1ccd","tlsh":"82b1a5a9066a70198b7097e487275816f55be5633380d294fb6c99881fb2534c3b2efc"},{"path":"lib/telemetry.js","sha256":"c58fdb04bfaf71ac77dcb01971d831a19a47b7717fba21a7997e8f32ff3164d8","tlsh":"eb835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"devplatform-spa-ui-35.8.2.tgz","hashes":{"sha1":"62e7a383fac5ab2c13bfb0ff2681f9fe199b554c","sha512_sri":"sha512-AksjhwtAtsMkaARbZNjJFL2EUpzszH7LcJ0LLV05c3D2WbdsecEZlfed4ozO4VdWcb8ny7FpccNwXeqfMsJvcQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-spa-ui/v/35.8.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015731","import_time":"2026-08-05T16:13:37.273698037Z","modified_time":"2026-08-05T15:31:21Z","sha256":"fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428","source":"amazon-inspector","versions":["35.8.2"]}]}}