Malicious code in ded-pwa-c-micro (npm)
The npm package ded-pwa-c-micro contained malicious code that downloads and executes unsigned platform-specific binaries from attacker-controlled Cloudflare Workers and DNS infrastructure upon require(). The package masquerades as legitimate software with fake telemetry/analytics comments.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of ded-pwa-c-micro; runtime execution of unsigned platform-specific binaries from attacker-controlled infrastructure.
- Ecosystems
- Attack vectors
- Affected entities
- ded-pwa-c-micronpm package containing malicious code in index.js and _shim.js
The npm package ded-pwa-c-micro was found to contain malicious code in its index.js and shim.js files. On require(), the package loads a shim that selects a platform-specific binary (linux_x64, linux_arm64, darwin, win32) and downloads it over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback channel under *.sdk.dl.wel1.ru.\n\nThe downloaded payload is written to /var/tmp or %TEMP% under masquerade filenames (.cache on POSIX, dotnet_diag_.exe on Windows), given execute permissions (0o755), and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. There is no hash verification, signature validation, or documented relationship between the downloaded binary and any stated package purpose.\n\nHostnames and DNS domains are constructed from split-and-join arrays, and in-code comments referencing "analytics_state", "telemetry", and "rate limit" provide misdirection. The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-qmf2-qw7j-fwjp.
Indicators of compromise
- Packages
- ded-pwa-c-micro
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
Remediation
- Remove ded-pwa-c-micro from all projects immediately
- Audit package.json and lock files for any presence of ded-pwa-c-micro
- Review process execution logs and network connections from systems that installed this package
- Assume any system that required this package may have executed attacker-controlled code; perform forensic analysis and consider re-imaging if compromise is suspected
- Use npm audit to check for this package in dependency trees
- Monitor for suspicious outbound HTTPS connections to Cloudflare Workers domains or DNS queries to *.sdk.dl.wel1.ru
Sources
- GitHub Advisory GHSA-qmf2-qw7j-fwjp · GitHub Advisory Database
Cite this entry
"Malicious code in ded-pwa-c-micro (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ded-pwa-c-micro-npm-1jb68l
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package