Malicious code in delivery-ci-dpat (npm)
The npm package delivery-ci-dpat contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers hosts or via DNS-TXT covert channels on module load. The payload is disguised as analytics/telemetry and uses obfuscation techniques to evade detection.
- Disclosed
- Last updated
- Blast radius
- All users of the delivery-ci-dpat npm package
- Ecosystems
- Attack vectors
- Affected entities
- delivery-ci-dpatnpm package containing malicious code
The npm package delivery-ci-dpat was found to contain malicious code that executes automatically when the module is required. The _platform.js file runs a setup() function at module load time that fetches platform-specific binaries from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev).
The malicious code writes the downloaded binary to a hidden path under /tmp or %TEMP%, sets executable permissions (0o755), and spawns it detached via shell commands (/bin/sh -c or cmd.exe /c start /b). A secondary delivery mechanism uses DNS-TXT records as a covert channel, querying *.dl.wel1.ru for base64-encoded payload chunks that are reassembled and executed.
The C2 hostnames and DNS fallback domain are assembled at runtime from fragmented strings to evade static code analysis. A filesystem timestamp is used to ensure the payload executes only once per system. The malicious behavior is labeled as analytics or telemetry to disguise its true purpose.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- delivery-ci-dpat
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- dl.wel1.ru
Remediation
- Immediately uninstall the delivery-ci-dpat package from all systems
- Audit npm package.json and lock files for any dependencies on delivery-ci-dpat
- Review system logs and process execution history for suspicious binary downloads or executions from the identified C2 domains
- Check /tmp and %TEMP% directories for hidden executable files created during the malicious module load
- Monitor DNS query logs for requests to *.dl.wel1.ru
- If the package was installed, assume system compromise and perform full security assessment
- Use npm audit to identify any other potentially malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-cm97-w294-4p9x · GitHub Advisory Database
Cite this entry
"Malicious code in delivery-ci-dpat (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-delivery-ci-dpat-npm-10bsp7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package