Malicious code in delivery-ci-documentation (npm)
The npm package delivery-ci-documentation contained malicious code that downloads and executes arbitrary attacker-controlled binaries on package import. The payload is fetched from attacker-controlled domains (oob-worker.cf10x-*.workers.dev and *.dl.wel1.ru) with no signature verification, enabling remote code execution on any system that required the package.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious delivery-ci-documentation package and executed it via require().
- Ecosystems
- Attack vectors
- Affected entities
- delivery-ci-documentationnpm package containing malicious code in index.js and _init.js
The npm package delivery-ci-documentation was found to contain malicious code designed to execute arbitrary code on the host system upon import. When the package is required, index.js loads _init.js, which selects a platform-specific payload endpoint and reconstructs destination hostnames at runtime by joining split string arrays.
The malicious code downloads an opaque binary over HTTPS from attacker-controlled hosts (oob-worker.cf10x-*.workers.dev). If HTTPS retrieval fails, it falls back to a DNS TXT covert channel that reassembles a base64-encoded payload from numbered subdomains under *.dl.wel1.ru. The fetched bytes are written to temporary directories (/tmp or %TEMP%) under disguised filenames such as .cache_ and dotnet_diag_.exe, made executable (chmod 0755 on POSIX), and spawned detached via shell commands.
No hash or signature verification is performed on the downloaded payload, the URLs are mutable, and the destination hosts do not match any legitimate publisher. Both the staging paths and transport mechanism are covert, indicating intentional obfuscation. The result is arbitrary attacker-controlled code execution on the installer's host at import time.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Domains
- oob-worker.cf10x-*.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately uninstall the delivery-ci-documentation package from all systems
- Audit npm install logs to identify all systems that installed this package
- Inspect /tmp and %TEMP% directories on affected systems for suspicious files matching patterns like .cache_ and dotnet_diag_.exe
- Review process execution logs for unexpected spawned processes on affected systems
- Consider the affected systems potentially compromised and perform forensic analysis
- Update npm dependencies to remove any reference to delivery-ci-documentation
- Monitor for indicators of compromise from the identified attacker-controlled domains
Sources
- GitHub Advisory GHSA-ccvq-qchw-qxwh · GitHub Advisory Database
Cite this entry
"Malicious code in delivery-ci-documentation (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-delivery-ci-documentation-npm-ncmrzt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in chlklib
Malware was discovered in the npm package chlklib, resulting in full system compromise of any computer with the package installed or running. All affected systems should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in chai-as-deployer
Malware was discovered in the npm package chai-as-deployer, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in checkout-common-tokens
Malware was discovered in the npm package checkout-common-tokens. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package