ded-pwa-c-mapping

{"modified":"2026-08-07T12:32:20Z","published":"2026-08-07T12:32:20Z","schema_version":"1.7.4","id":"MAL-2026-13535","summary":"Malicious code in ded-pwa-c-mapping (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18)\nOn require of the package, _helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS from string-concatenated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf102-baf, cf103-070, cf99-9b3) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames are assembled at runtime by joining fragments to defeat string scanners; a.analytics_state marker file throttles re-execution, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK opt-out variables are referenced to frame the behavior as telemetry. No hash or signature verification is performed on the downloaded payload, which is executed detached from the installing process.\n","affected":[{"package":{"ecosystem":"npm","name":"ded-pwa-c-mapping"},"versions":["35.8.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"feddfc1d284b3fb26a6104a096d65aeb31b396a1d250ced191cd5f2c6d0a7433","tlsh":"6cb1865a126570284b70ebe0c61b9425f66af6633681c5c4f75c99885fb36248373dfc"}],"package_integrity":[{"filename":"ded-pwa-c-mapping-35.8.7.tgz","hashes":{"sha1":"084698f849f2b031cbcdd66136db23d5e01d348d","sha512_sri":"sha512-22D9LS2vnlNSPTb4hPkTkTlQdcz8hLdxtx2+PySC0zmFK6N45Odj16Jvcm7lIwEHmNAI9RtRTPcLon6mGkEjPw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-pwa-c-mapping/v/35.8.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017021","import_time":"2026-08-07T12:51:22.515706694Z","modified_time":"2026-08-07T12:32:20Z","sha256":"111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18","source":"amazon-inspector","versions":["35.8.7"]}]}}