ded-pwa-c-page-maker-props

{"modified":"2026-08-07T12:11:39Z","published":"2026-08-07T12:11:39Z","schema_version":"1.7.4","id":"MAL-2026-13497","summary":"Malicious code in ded-pwa-c-page-maker-props (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da)\nOn require of the package, _compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers hosts (oob-worker.cf101/cf102/cf103-*.workers.dev, cf99-9b3.workers.dev), writes it to /tmp/.cache_<rand> on POSIX or %TEMP%\\dotnet_diag_<rand>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh or cmd.exe. Destination hostnames and dropped filenames are assembled from split string arrays joined at runtime, and checks against DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as a cover story to gate the drop. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel: it queries c.<domain> under *.dl.wel1.ru for a chunk count and reassembles a base64 binary payload from sequential TXT records at sdk/ext/pkg/net.dl.wel1.ru. The package advertises itself as a PWA props module but ships no such functionality; the sole install/import-time effect is fetching and executing an unsigned attacker binary on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"ded-pwa-c-page-maker-props"},"versions":["35.7.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"674c134c2a32dcf11407da45f28c36772ccc1864a2b869a02074add2bea047f0","tlsh":"80b1859a06ba7018cbf097e487175816f65be6632380c6a4fb6ca5841f7716483b2dfc"}],"package_integrity":[{"filename":"ded-pwa-c-page-maker-props-35.7.7.tgz","hashes":{"sha1":"db9f6ddba0dcd191ae31b341ce75730aacfb4467","sha512_sri":"sha512-qqTKMnT0ldT85I9ksvPWsh7/gHRUaAq2hc1aHSDGd46lrHYCtLkSz0EmHlVX3QpjiP5RJmG4QxPVYJCHoPNZBg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-pwa-c-page-maker-props/v/35.7.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016877","import_time":"2026-08-07T12:23:25.415304744Z","modified_time":"2026-08-07T12:11:39Z","sha256":"4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da","source":"amazon-inspector","versions":["35.7.7"]}]}}