delivery-ci-core

{"modified":"2026-08-07T12:32:53Z","published":"2026-08-07T12:32:53Z","schema_version":"1.7.4","id":"MAL-2026-13540","summary":"Malicious code in delivery-ci-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335)\nindex.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) from split string arrays, with a DNS TXT-record fallback under *.dl.wel1.ru that base64-reassembles the payload. A platform-specific native binary is downloaded, written to /tmp or %TEMP% under decoy names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Dangerous API and module names are obfuscated by string splitting (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade static inspection. lib/telemetry.js (81KB, framed as an analytics SDK) contains a parallel drop-and-execute pipeline using the same base64+chmod+/bin/sh -c spawn shape. Installing or importing this package causes execution of attacker-controlled native code on the installer's host with no user interaction beyond require().\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-core"},"versions":["35.3.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"0189046bc2ea2c4749406de5aa13bc6cddeee8647d7a1226f6c08848311b1dd3","tlsh":"f8a1859612aa70294bb09bf4c6175416f657f6633780c2d8fb9ca9941f72124c3b2efc"},{"path":"lib/telemetry.js","sha256":"8b66dccd5b86f01dcdb10862e056b838dc8489b80726f29febb3e74d63295036","tlsh":"01835055566a242186b2b368df234007ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"delivery-ci-core-35.3.7.tgz","hashes":{"sha1":"3379b1a34916f52c890da833be7f1a95c5e8f19a","sha512_sri":"sha512-qjrHE6oZfXiZj4A0mAj7ytog+RP9uoedmEjmGnb327+8PBj83XyIedVkswFerSA2plo02ye+juOxhSqCrKdWkQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-core/v/35.3.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017025","import_time":"2026-08-07T12:51:22.737198355Z","modified_time":"2026-08-07T12:32:53Z","sha256":"8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335","source":"amazon-inspector","versions":["35.3.7"]}]}}