Malicious code in delivery-ci-jira-rnd (npm)
The npm package delivery-ci-jira-rnd contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on package require. The attack used obfuscated hostnames, DNS-TXT covert channels, and hidden temporary file paths to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any npm user installing delivery-ci-jira-rnd
- Ecosystems
- Attack vectors
- Affected entities
- delivery-ci-jira-rndnpm package containing malicious code
The npm package delivery-ci-jira-rnd was found to contain malicious code in its index.js entry point. Upon require, the package loads _bridge.js which implements a multi-stage attack chain.
The malware downloads platform-specific binaries from Cloudflare Workers hosts with obfuscated domain names assembled from split string literals (e.g., "oob-worker"+".cf102-baf.workers."+"dev" and variants cf101/cf103). A DNS-TXT covert-channel fallback reassembles base64-encoded payloads from numbered subdomains under sdk.dl.wel1.ru.
Downloaded bytes are written to hidden paths in /tmp or %TEMP% with names like ".cache_ " or "dotnet_diag_ .exe", marked executable (chmod 0755), and spawned detached via /bin/sh -c or cmd.exe. Execution is gated by a TTL stamp file and falsely labeled as telemetry. The hostname obfuscation and DNS-TXT fallback indicate intentional evasion of static string scanning.
The incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-gr32-hfrv-p7fq.
Indicators of compromise
- Packages
- delivery-ci-jira-rnd
- Domains
- sdk.dl.wel1.ru
Remediation
- Immediately uninstall delivery-ci-jira-rnd from all systems
- Audit npm package.json and lock files for any dependency on delivery-ci-jira-rnd
- Review system logs and process execution history for suspicious activity from /tmp or %TEMP% directories
- Check for outbound HTTPS connections to Cloudflare Workers domains or DNS queries to sdk.dl.wel1.ru subdomains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm to the latest version and run npm audit to identify other malicious packages
Sources
- GitHub Advisory GHSA-gr32-hfrv-p7fq · GitHub Advisory Database
Cite this entry
"Malicious code in delivery-ci-jira-rnd (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-delivery-ci-jira-rnd-npm-h7phc1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in disksweep
The npm package disksweep was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in cloud-agen-bot
The npm package cloud-agen-bot contains malware that grants full control of affected systems to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in club-sauce
Malware discovered in the npm package club-sauce. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in arc-diag-util
The npm package arc-diag-util was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys should be rotated immediately from a different machine, and the package should be removed.
npmCompromised package