Malicious code in devplatform-spa-errors (npm)
The npm package devplatform-spa-errors contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers domains and DNS-TXT fallback channels upon module require(). The package was identified by Amazon Inspector and credited to OpenSSF's malicious-packages repository.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious devplatform-spa-errors package and required it in their code would execute the attacker-controlled native binary payload on module load.
- Ecosystems
- Attack vectors
- Affected entities
- devplatform-spa-errorsnpm package containing malicious dropper code
The npm package devplatform-spa-errors was found to contain malicious code that executes on module load. The index.js file unconditionally loads loader.js, which implements a multi-stage dropper mechanism.\n\nThe dropper selects a platform-specific payload path and fetches an opaque native binary from attacker-controlled Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback to *.dl.wel1.ru. The binary is written to a temporary path disguised as dotnet_diag.exe on Windows or .cache_ on POSIX systems, made executable (chmod 0755), and spawned detached via shell commands.\n\nHostnames and filenames are assembled at runtime from split-string arrays and framed with Analytics/telemetry SDK cover strings to evade detection. A duplicate copy of the dropper logic exists in lib/telemetry.js, disguised as a Sentry-like observability module. The package delivers attacker-controlled native code with no integrity verification and active string obfuscation.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf99-9b3.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately uninstall devplatform-spa-errors from all systems and projects
- Audit npm install logs and dependency trees to identify all systems that may have installed this package
- Scan affected systems for the presence of dropped binaries (dotnet_diag_*.exe on Windows, .cache_* on POSIX)
- Review process execution logs for suspicious spawned processes from node or npm contexts
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm lockfiles and reinstall dependencies from a clean state
- Monitor for indicators of compromise from the identified C2 domains and DNS channels
Sources
- GitHub Advisory GHSA-m8j7-pqmj-c2j8 · GitHub Advisory Database
Cite this entry
"Malicious code in devplatform-spa-errors (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-devplatform-spa-errors-npm-31wo5a
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in github-policy-bot (npm)
The npm package github-policy-bot contained malicious code that exfiltrated host identifiers and environment metadata during installation via a postinstall script. The package name shadowed a legitimate Google-owned repository and was authored under a placeholder account claiming security research purposes.
npmCompromised packageTyposquatting - containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - containedcritical
Malicious code in flydev (npm)
The npm package flydev contains malicious code designed to destroy Windows systems. The package masquerades as a utility but executes destructive operations including filesystem deletion, process termination, memory exhaustion, and fork bombs when invoked.
npmCompromised package - containedcritical
Malicious code in npm-wold (npm)
npm-wold@1.1.1 contains malicious code in its postinstall script that fetches remote JSON from a hardcoded endpoint and dynamically invokes attacker-controlled functions with attacker-supplied arguments, enabling code execution at install time.
npmCompromised package