Malicious code in ded-pwa-test-pub-pkg (npm)
The npm package ded-pwa-test-pub-pkg contained malicious code that downloads and executes platform-specific binaries from anonymous CDN endpoints on module load. The package was identified by Amazon Inspector and credited to OpenSSF's malicious-packages repository.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected package versions
- Ecosystems
- Attack vectors
- Affected entities
- ded-pwa-test-pub-pkgnpm package containing malicious code
The npm package ded-pwa-test-pub-pkg was found to contain malicious code in its index.js file. On module load, the package requires a hidden compatibility module that assembles remote hostnames from obfuscated string literals and constructs URLs to anonymous CDN endpoints (*.workers.dev variants and *.dl.wel1.ru DNS-TXT fallback).
The malicious code fetches platform-specific binaries via HTTPS and writes them to disguised paths in temporary directories (/tmp/.cache_ or %TEMP%\dotnet_diag_.exe on Windows). The files are made executable and spawned detached via shell commands, executing with the installer's privileges.
The package includes anti-analysis measures: a stamp file at /tmp/.analytics_state prevents re-execution, and environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) skip execution in likely analysis environments. Log calls are stubbed to hide activity.
The incident was discovered by Amazon Inspector and documented in the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- ded-pwa-test-pub-pkg
- Domains
- oob-worker.cf1.workers.dev
- dl.wel1.ru
Remediation
- Immediately remove ded-pwa-test-pub-pkg from all projects and dependencies
- Audit package.json and lock files for any presence of this package
- Review and revoke any credentials or secrets that may have been exposed on affected systems
- Scan systems that installed this package for unauthorized binaries in /tmp and %TEMP% directories
- Monitor for suspicious network connections to *.workers.dev and *.dl.wel1.ru domains
- Update to a clean version if a legitimate replacement is available, or use an alternative package
Sources
- GitHub Advisory GHSA-gjg9-xfwf-m6fx · GitHub Advisory Database
Cite this entry
"Malicious code in ded-pwa-test-pub-pkg (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ded-pwa-test-pub-pkg-npm-17rpse
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in agentsync-pkg
Malware discovered in the npm package agentsync-pkg. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in sui-move-rpc
Malware was discovered in the npm package sui-move-rpc, resulting in full system compromise of any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in envfile-sync-cli
Malware was discovered in the npm package envfile-sync-cli, providing full system compromise to any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @zizie071/libsignal-node
The npm package @zizie071/libsignal-node contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package