Malicious code in ded-pwa-ded-pwa-core (npm)
The npm package ded-pwa-ded-pwa-core contained malicious code that executes arbitrary binaries fetched from attacker-controlled Cloudflare Workers endpoints upon installation or require(). The attack uses obfuscation techniques including string splitting and identifier fragmentation to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installs or requires ded-pwa-ded-pwa-core
- Ecosystems
- Attack vectors
- Affected entities
- ded-pwa-ded-pwa-corenpm package containing malicious code in index.js and _adapter.js
The npm package ded-pwa-ded-pwa-core was found to contain malicious code in its index.js and adapter.js files. Upon installation or when the package is required, the code unconditionally loads adapter.js, which selects a platform-specific target path (e.g., %TEMP%/dotnet_diag.exe on Windows or /tmp/.cache on POSIX systems).
The malicious code fetches an opaque binary over HTTPS from author-controlled Cloudflare Workers endpoints, writes it to disk with executable permissions (chmod 0755), and executes it via detached process spawning. The destination hostnames are reconstructed at runtime using split-string arrays (e.g., ['oob-worker.cf100-416.workers.','dev'].join('') and ['sdk.','dl','.wel1','.r','u'].join('') yielding sdk.dl.wel1.ru) to evade static code analysis. Similarly, require() calls and filesystem operations are obfuscated through string concatenation (e.g., require('child_'+'process') and fs['chmod'+'Sync']).
A DNS-TXT chunked-base64 fallback mechanism via *.dl.wel1.ru is present as an alternative delivery method. The staged filenames masquerade as .NET diagnostics tooling or hidden cache files, and environment variable checks (DO_NOT_TRACK / ANALYTICS_OPT_OUT) provide a false telemetry cover story. The executed binary is opaque, author-controlled, and lacks version pinning or hash verification.
The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-q534-q94q-5267.
Indicators of compromise
- Packages
- ded-pwa-ded-pwa-core
- Domains
- sdk.dl.wel1.ru
- oob-worker.cf100-416.workers.dev
Remediation
- Immediately uninstall ded-pwa-ded-pwa-core from all systems
- Audit npm package.json and lock files for any presence of ded-pwa-ded-pwa-core
- Review system logs and process execution history for suspicious binaries spawned from Node.js processes, particularly from /tmp/.cache_ or %TEMP%/dotnet_diag_.exe
- Block outbound HTTPS connections to Cloudflare Workers endpoints and sdk.dl.wel1.ru at the network level
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Scan affected systems for persistence mechanisms or additional malware
- Use npm audit to check for other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-q534-q94q-5267 · GitHub Advisory Database
Cite this entry
"Malicious code in ded-pwa-ded-pwa-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ded-pwa-ded-pwa-core-npm-zpj03p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit