Malicious code in devplatform-api-v1-resources (npm)
The npm package devplatform-api-v1-resources contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure upon package import. The malicious payload uses obfuscation techniques including fragmented C2 hostnames, base64 assembly, and DNS fallback mechanisms to evade detection.
- Disclosed
- Last updated
- Blast radius
- All users of devplatform-api-v1-resources npm package
- Ecosystems
- Attack vectors
- Affected entities
- devplatform-api-v1-resourcesnpm package containing malicious code in setup.js and lib/telemetry.js
The npm package devplatform-api-v1-resources was found to contain malicious code in its setup.js and lib/telemetry.js files. Upon require of the package's main entry point, the code fetches platform-specific binaries from Cloudflare Workers hosts with dynamically reassembled domain names (e.g., oob-worker.cf101-*.workers.dev, oob-worker.cf99-9b3.workers.dev) and includes DNS TXT record fallbacks to *.dl.wel1.ru.\n\nThe downloaded binaries are written to temporary directories (/var/tmp on POSIX systems or Windows TEMP directory) under disguised filenames (dotnet_diag_.exe, .cache_), given executable permissions (chmod 0755), and executed detached via /bin/sh on POSIX or cmd on Windows. No cryptographic verification of the downloaded content is performed.\n\nA second instance of the same malicious pattern appears in lib/telemetry.js, using base64 chunk assembly and obfuscated API calls (e.g., fs["chmod"+"Sync"]) to further evade static analysis. Command and control hostnames are fragmented and concatenated at runtime, with endpoints rotating across multiple workers.dev subdomains and .ru DNS fallbacks.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- devplatform-api-v1-resources
- Domains
- oob-worker.cf101-*.workers.dev
- oob-worker.cf99-9b3.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately remove devplatform-api-v1-resources from all projects and dependencies
- Audit all systems where this package was installed for signs of unauthorized binary execution or data exfiltration
- Review process execution logs and network traffic for connections to oob-worker.cf*.workers.dev or *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm lockfiles and reinstall dependencies from a clean state
- Monitor for similar obfuscation patterns in other dependencies
Sources
- GitHub Advisory GHSA-5wmv-c96f-9mv4 · GitHub Advisory Database
Cite this entry
"Malicious code in devplatform-api-v1-resources (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-devplatform-api-v1-resources-npm-tot6fy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package