ded-pwa-c-cms

{"modified":"2026-08-07T12:12:54Z","published":"2026-08-07T12:12:54Z","schema_version":"1.7.4","id":"MAL-2026-13496","summary":"Malicious code in ded-pwa-c-cms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b)\nOn require('ded-pwa-c-cms'), index.js loads _platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from obfuscated author-controlled hosts (Cloudflare Workers subdomains such as oob-worker.cf*-*.workers.dev and *.dl.wel1.ru subdomains including sdk/ext/pkg/net), with a DNS-TXT chunked base64 fallback channel (count read from c.<domain>, chunks read from i.<domain>). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or the cmd equivalent). C2 hostnames are reassembled at runtime from split-string arrays joined with.join(''), and execution is gated behind DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks as a telemetry cover story. The package advertises itself as a pluggable CMS interface with no dependencies and no legitimate need for a native binary; the dotnet_diag filename masquerades as a Microsoft diagnostic tool. No hash/signature verification is performed on the fetched payload.\n","affected":[{"package":{"ecosystem":"npm","name":"ded-pwa-c-cms"},"versions":["35.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"938bed9ce74ce9c7d5a0429a10db5780eaf59a8b1ec91454339cfb4fab636980","tlsh":"bda1b65a026630198bb0d7e4c7175416f65be6633380c294fbaca5885fb716483b2efc"}],"package_integrity":[{"filename":"ded-pwa-c-cms-35.9.9.tgz","hashes":{"sha1":"6de617c6a58bab1a66ebe32613c1b4a2958695d0","sha512_sri":"sha512-epLAMxUK9eD1aoxpZ5IdOaQyL+/wL6EwAiQu0J7GVLrb0vi3T6lzkXnNChRxT8EGR+hhCay5HobkHn/2Dysz6Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-pwa-c-cms/v/35.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016886","import_time":"2026-08-07T12:23:25.748687606Z","modified_time":"2026-08-07T12:12:54Z","sha256":"49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b","source":"amazon-inspector","versions":["35.9.9"]}]}}