delivery-ci-documentation

{"modified":"2026-08-07T12:26:17Z","published":"2026-08-07T12:26:17Z","schema_version":"1.7.4","id":"MAL-2026-13541","summary":"Malicious code in delivery-ci-documentation (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203)\nOn require('delivery-ci-documentation'), index.js loads _init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames at runtime by joining split string arrays, and downloads an opaque binary over HTTPS from oob-worker.cf10x-*.workers.dev hosts. When HTTPS retrieval fails, it falls back to a DNS TXT covert channel that reassembles a base64-encoded payload from numbered subdomains under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmod 0755 on POSIX, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. No hash or signature verification is performed, the URLs are mutable, the destination hosts do not match any legitimate publisher for a package advertised as a documentation abstraction, and both the staging paths and the transport are covert. The result is arbitrary attacker-controlled code execution on the installer's host on import.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-documentation"},"versions":["35.3.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"ee9f9ccadfa16e38ea35ab216fce31573587658d9b03030d89201211894753ab","tlsh":"1da1885a166a70188bb0d7e4c7275416fa5bf66333c0c6d4fb5ca5981fb21248272efc"}],"package_integrity":[{"filename":"delivery-ci-documentation-35.3.7.tgz","hashes":{"sha1":"04551d79f775c79847b8fc82e304a8eff5554cc3","sha512_sri":"sha512-wfkCO8Yy0UM0D26KDB8dVdjgPbjCBOLidZludkAUcYznAIaqXojZa0bf3JtPPlkcXha3g/idsA8lPQ7mTbnP/g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-documentation/v/35.3.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016980","import_time":"2026-08-07T12:51:20.739193126Z","modified_time":"2026-08-07T12:26:17Z","sha256":"af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203","source":"amazon-inspector","versions":["35.3.7"]}]}}