Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in delivery-ci-codeceptjs-fork (npm)

The npm package delivery-ci-codeceptjs-fork contained malicious code that executed remote code on installation/require. The dropper reconstructed attacker-controlled hostnames, downloaded platform-specific binaries, and spawned them with detached shell execution, with a DNS-TXT covert-channel fallback.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system installing or requiring the delivery-ci-codeceptjs-fork package
Ecosystems
Attack vectors
Affected entities
  • delivery-ci-codeceptjs-forknpm package containing malicious code in _runtime.js and lib/telemetry.js

The npm package delivery-ci-codeceptjs-fork contained embedded malicious code designed to execute remote code at install or require time. The primary attack mechanism was located in the package's main entry point (_runtime.js) and duplicated in lib/telemetry.js (framed as an 'Analytics SDK').

The malicious code reconstructed attacker-controlled hostnames via string-splitting obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev) and downloaded platform-specific binaries over HTTPS. The fetched bytes were written to temporary directories (/tmp or %TEMP%) under disguised names (.cache_ on POSIX, dotnet_diag_.exe on Windows), made executable (chmod 755), and spawned detached via shell commands.

A secondary covert-channel mechanism used DNS-TXT records under *.dl.wel1.ru to reassemble base64-encoded payload bytes from chunked records. The combination of hostname obfuscation, opaque unverified payloads, disguised staging paths mimicking legitimate diagnostics binaries, and detached execution established install/load-time remote code execution against any system importing the package.

The incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • delivery-ci-codeceptjs-fork
Domains
  • oob-worker.cf101-adf.workers.dev
  • oob-worker.cf103-070.workers.dev
  • oob-worker.cf100-416.workers.dev
  • dl.wel1.ru

Remediation

  • Immediately uninstall delivery-ci-codeceptjs-fork from all systems
  • Audit npm package.json and lock files for any presence of this package
  • Review system logs and process execution history for suspicious shell spawning or binary downloads from the identified domains (oob-worker.cf*.workers.dev, *.dl.wel1.ru)
  • Monitor for unexpected network connections to the attacker-controlled domains
  • Regenerate any credentials or secrets that may have been exposed on affected systems
  • Use npm audit to identify and remove the malicious package from dependency trees

Sources

  1. GitHub Advisory GHSA-x6hr-5vj6-f8cq · GitHub Advisory Database

Cite this entry

"Malicious code in delivery-ci-codeceptjs-fork (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-delivery-ci-codeceptjs-fork-npm-2873z6

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in akamaijs-sensor (npm)

    The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.

    npmCompromised packageMalicious commit
  2. containedcritical

    Malicious code in @wololasod/tiny-id (npm)

    The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in twilio-hackerone-poc-afe6937c (npm)

    The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.

    npmCompromised packageMalicious commit
  4. resolvedcritical

    Malicious code in akamaijs-sensorv1 (npm)

    The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.

    npmCompromised packageMalicious commit