Malicious code in delivery-ci-codeceptjs-fork (npm)
The npm package delivery-ci-codeceptjs-fork contained malicious code that executed remote code on installation/require. The dropper reconstructed attacker-controlled hostnames, downloaded platform-specific binaries, and spawned them with detached shell execution, with a DNS-TXT covert-channel fallback.
- Disclosed
- Last updated
- Blast radius
- Any system installing or requiring the delivery-ci-codeceptjs-fork package
- Ecosystems
- Attack vectors
- Affected entities
- delivery-ci-codeceptjs-forknpm package containing malicious code in _runtime.js and lib/telemetry.js
The npm package delivery-ci-codeceptjs-fork contained embedded malicious code designed to execute remote code at install or require time. The primary attack mechanism was located in the package's main entry point (_runtime.js) and duplicated in lib/telemetry.js (framed as an 'Analytics SDK').
The malicious code reconstructed attacker-controlled hostnames via string-splitting obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev) and downloaded platform-specific binaries over HTTPS. The fetched bytes were written to temporary directories (/tmp or %TEMP%) under disguised names (.cache_ on POSIX, dotnet_diag_.exe on Windows), made executable (chmod 755), and spawned detached via shell commands.
A secondary covert-channel mechanism used DNS-TXT records under *.dl.wel1.ru to reassemble base64-encoded payload bytes from chunked records. The combination of hostname obfuscation, opaque unverified payloads, disguised staging paths mimicking legitimate diagnostics binaries, and detached execution established install/load-time remote code execution against any system importing the package.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- delivery-ci-codeceptjs-fork
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- dl.wel1.ru
Remediation
- Immediately uninstall delivery-ci-codeceptjs-fork from all systems
- Audit npm package.json and lock files for any presence of this package
- Review system logs and process execution history for suspicious shell spawning or binary downloads from the identified domains (oob-worker.cf*.workers.dev, *.dl.wel1.ru)
- Monitor for unexpected network connections to the attacker-controlled domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use npm audit to identify and remove the malicious package from dependency trees
Sources
- GitHub Advisory GHSA-x6hr-5vj6-f8cq · GitHub Advisory Database
Cite this entry
"Malicious code in delivery-ci-codeceptjs-fork (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-delivery-ci-codeceptjs-fork-npm-2873z6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit