delivery-ci-dpat

{"modified":"2026-08-07T12:14:41Z","published":"2026-08-07T12:14:41Z","schema_version":"1.7.4","id":"MAL-2026-13500","summary":"Malicious code in delivery-ci-dpat (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f)\nOn require() of delivery-ci-dpat, _platform.js runs setup() at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a hidden path under /tmp or %TEMP%, chmods it 0o755, and spawns it detached via /bin/sh -c '<file> &' or cmd.exe /c start /b. A DNS-TXT covert channel provides a fallback delivery path: dnsChunked() queries c.<domain> under *.dl.wel1.ru for a chunk count, iterates 0..N.<domain> collecting base64-encoded TXT records, reassembles them into a binary buffer, and executes the reconstructed payload the same way. The C2 hostnames and DNS fallback domain are assembled at runtime from split-string fragments (['oob-worker.cf101-adf.worker','s.','dev'].join(''); ['sdk.dl.wel','1.r','u'].join('')) to evade static matching. A filesystem stamp is used for run-once dedup and the behavior is labeled as analytics/telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-dpat"},"versions":["35.1.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"544ae2551542aabd106a908dd5d4d0862eca8c0393f024c5eb463116fe7f36a5","tlsh":"e3a1989a16aa70084bb097e4c71b4819f65bf6633780c584f79c65985fb712483b2efc"}],"package_integrity":[{"filename":"delivery-ci-dpat-35.1.5.tgz","hashes":{"sha1":"b634e9c96c59d2d1e6ed1d98820ad4623326a9e8","sha512_sri":"sha512-MgHEDOAl7lGTqn7odBa4eDA+3iPBXOhW7un9xK/4ukjvbnD0zCjbaDhRwlimaGmFY/igtjAAoTCsdsS2WJ/1ZA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-dpat/v/35.1.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016898","import_time":"2026-08-07T12:23:26.296652805Z","modified_time":"2026-08-07T12:14:41Z","sha256":"dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f","source":"amazon-inspector","versions":["35.1.5"]}]}}