Malicious code in devplatform-react-mcp (npm)
devplatform-react-mcp@35.5.6 on npm is a malicious dropper disguised as a React MCP SDK that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers and Russian domains upon installation. The package uses obfuscation techniques (runtime string concatenation, base64 encoding) to evade static analysis and spawns detached processes to execute the downloaded payloads.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed devplatform-react-mcp@35.5.6 would execute attacker-controlled binaries on their host machine.
- Ecosystems
- Attack vectors
- Affected entities
- devplatform-react-mcp · 35.5.6
devplatform-react-mcp@35.5.6 is a malicious npm package that functions as a dropper for arbitrary binaries. Upon require(), the package's index.js loads helpers.js, which assembles three Cloudflare Workers hostnames from fragmented strings at runtime and downloads a platform-specific binary via HTTPS. The binary is written to /tmp/.cache on Unix-like systems or %TEMP%\dotnet_diag_.exe on Windows, given execute permissions (0755), and spawned as a detached process.
The package implements a secondary dropper pipeline in lib/telemetry.js that repeats the same attack primitives under the guise of an 'analytics SDK'. Both pipelines use runtime string concatenation to obfuscate identifiers such as child_process and chmodSync, evading static analysis tools.
A DNS-TXT fallback mechanism resolves additional payload sources under the Russian domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The package contains no legitimate native-build functionality; its sole observable behavior on load is fetching and executing opaque attacker-controlled binaries on the installer's host.
This incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-mcm8-ccm7-f469.
Indicators of compromise
- Packages
- devplatform-react-mcp@35.5.6
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall devplatform-react-mcp@35.5.6 from all systems and projects
- Audit npm install logs and package-lock.json files to identify any installations of this version
- Inspect systems that installed this package for unexpected processes, network connections to the listed Cloudflare Workers and Russian domains, and suspicious binaries in /tmp/.cache_ or %TEMP%\dotnet_diag_.exe
- Block outbound connections to oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, and *.dl.wel1.ru at the network level
- Review npm package dependencies for any reliance on devplatform-react-mcp and replace with legitimate alternatives
- Consider running malware scans on any system that executed this package
Sources
- GitHub Advisory GHSA-mcm8-ccm7-f469 · GitHub Advisory Database
Cite this entry
"Malicious code in devplatform-react-mcp (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-devplatform-react-mcp-npm-g536lr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malware in a.poltoradnev-package-c
Malware was discovered in the npm package a.poltoradnev-package-c. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in userbotjs-jun
The npm package userbotjs-jun was found to contain malware, potentially providing full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package