Malicious code in ded-pwa-c-cms (npm)
The npm package ded-pwa-c-cms contains malicious code that downloads and executes arbitrary binaries from attacker-controlled hosts when the package is required. The package masquerades as a CMS interface with no legitimate need for native binary execution.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installs and requires the ded-pwa-c-cms package will execute arbitrary attacker-controlled binaries on the host system.
- Ecosystems
- Attack vectors
- Affected entities
- ded-pwa-c-cmsnpm package containing malicious code in index.js and _platform.js
The npm package ded-pwa-c-cms contains embedded malicious code that executes when the package is required. Upon import, index.js loads platform.js, which selects a platform-specific URL and downloads an opaque binary over HTTPS from obfuscated author-controlled hosts, including Cloudflare Workers subdomains (oob-worker.cf*-*.workers.dev) and wel1.ru subdomains. The package includes a DNS-TXT chunked base64 fallback channel for command and control.\n\nThe downloaded binary is written to /tmp/.cache on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, marked executable (chmod 0755), and spawned detached via shell execution. C2 hostnames are reassembled at runtime from split-string arrays, and execution is gated behind environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) as a cover story for telemetry.\n\nThe package advertises itself as a pluggable CMS interface with no dependencies and has no legitimate need for native binary execution. The dotnet_diag filename masquerades as a Microsoft diagnostic tool. No hash or signature verification is performed on the fetched payload, allowing arbitrary code execution on any system that requires this package.
Indicators of compromise
- Domains
- oob-worker.cf-*.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately remove ded-pwa-c-cms from all projects and dependencies
- Audit all systems where this package was installed for signs of compromise or unauthorized binary execution
- Review environment variables and system logs for evidence of malicious payload execution
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Monitor for network connections to the identified C2 domains (oob-worker.cf*-*.workers.dev and *.dl.wel1.ru)
- Use npm audit to identify any transitive dependencies on this package and remove them
Sources
- GitHub Advisory GHSA-jp7v-p7hf-jrvm · GitHub Advisory Database
Cite this entry
"Malicious code in ded-pwa-c-cms (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ded-pwa-c-cms-npm-603hwm
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit