delivery-ci-jira

{"modified":"2026-08-07T12:35:51Z","published":"2026-08-07T12:35:51Z","schema_version":"1.7.4","id":"MAL-2026-13542","summary":"Malicious code in delivery-ci-jira (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d)\nOn require() of delivery-ci-jira, _vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a base64-over-DNS TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path with a disguised filename, chmod 755 (or renamed.exe on Windows), and spawned detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" &\"], {detached:true}). Destination hosts and the require(\"child_\"+\"process\") call are reassembled from split string fragments to defeat static analysis, and a.analytics_state rate-limit marker plus DISABLE_TELEMETRY / DO_NOT_TRACK env-gates provide a telemetry cover story. lib/telemetry.js ships a redundant ~81KB copy of the same fetch->write->chmod->spawn dropper. The delivered binary is opaque, unpinned, unverified, and unrelated to the package's stated CI/Jira-adapter purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-jira"},"versions":["35.5.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"d2af2f703958930d0f3d8389b14d510b845f73185cfe46aab4641350369e02d8","tlsh":"44b1669a166a70198b709bf4c7275415f666f66333808284f75ca9981fb712483b2efc"},{"path":"lib/telemetry.js","sha256":"cdc4c6981e781f8a35171fd28065bd631c85c52f923f7cd4aa81844d721f5cb1","tlsh":"12835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"delivery-ci-jira-35.5.2.tgz","hashes":{"sha1":"1a1ead793940e19ba52a7276e1a0fc3e1919ecba","sha512_sri":"sha512-DvOj3TZGZLgagPvSgI10JZnZwz1pKaCDB9bdgeI6DwEvXCwwNlcK3vH5dB3q2kmBBnVMUilUvAkVSlxIeaSuvw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-jira/v/35.5.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017044","import_time":"2026-08-07T12:51:23.641188254Z","modified_time":"2026-08-07T12:35:51Z","sha256":"dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d","source":"amazon-inspector","versions":["35.5.2"]}]}}