Malicious code in delivery-ci-cli (npm)
delivery-ci-cli npm package contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers and DNS-TXT covert channels, with fallback mechanisms to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed delivery-ci-cli from npm
- Ecosystems
- Attack vectors
- Affected entities
- delivery-ci-clinpm package containing malicious dropper code
The npm package delivery-ci-cli contained malicious code in its index.js that loads a bootstrap.js module. This module downloads platform-specific native binaries from attacker-controlled Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and writes them to temporary directories under obfuscated names such as .cache, dotnet_diag_.exe, and .analytics_state before executing them with elevated permissions.
The malicious code implements multiple evasion techniques. Hostnames and API names are assembled at runtime using array.join to evade static string matching. If HTTPS downloads fail, the code falls back to a DNS-TXT covert channel, querying TXT records at subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-decoding the concatenated responses into executable buffers.
No hash or signature verification is performed on downloaded binaries. The package was disguised as a benign 'CI CLI SDK' with empty dependencies to avoid suspicion. The malicious behavior is triggered automatically on require of the package, affecting any developer or CI/CD system that installed it.
Indicators of compromise
- Packages
- delivery-ci-cli
- Domains
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall delivery-ci-cli from all systems and CI/CD pipelines
- Audit npm package.json files and lock files for any presence of delivery-ci-cli
- Review system logs and process execution history for suspicious binary execution from /var/tmp or %TEMP% directories
- Check for unexpected network connections to the identified Cloudflare Workers hosts and wel1.ru subdomains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm to the latest version and run 'npm audit' to identify other potentially compromised dependencies
Sources
- GitHub Advisory GHSA-gv48-wj3w-gf5j · GitHub Advisory Database
Cite this entry
"Malicious code in delivery-ci-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-delivery-ci-cli-npm-1jyrt4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package