Malicious code in devplatform-spa-plugin-feature-toggle (npm)
devplatform-spa-plugin-feature-toggle@35.7.4 on npm contains malicious code that executes attacker-controlled binaries on the installer's host at module import time. The package downloads OS-specific executables from anonymous Cloudflare Workers and DDNS hosts, writes them to temporary directories, and executes them with elevated permissions.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installs devplatform-spa-plugin-feature-toggle@35.7.4
- Ecosystems
- Attack vectors
- Affected entities
- devplatform-spa-plugin-feature-toggle · 35.7.4
The npm package devplatform-spa-plugin-feature-toggle version 35.7.4 contains embedded malicious code that executes arbitrary binaries during module import. The package's main entry point loads _support.js, which constructs three hardcoded origins under .workers.dev (oob-worker.cf101/cf102/cf103-) using array-join concatenation to evade string scanning, with a DNS-TXT base64-chunked fallback under *.dl.wel1.ru.
Upon execution, the malicious code downloads an OS-specific binary payload and writes it to /var/tmp/.cache_ on Unix systems or %TEMP%/dotnet_diag_.exe on Windows. The binary is then made executable (chmod 0755) and spawned detached via /bin/sh -c on Unix or cmd.exe /c start /b on Windows.
The package uses deceptive naming ("analytics_state", "telemetry", "dotnet_diag") that does not match its advertised feature-toggle functionality. A secondary malicious variant exists in lib/telemetry.js with similar drop-and-exec primitives framed as an "Analytics SDK". The payload is delivered from anonymous Cloudflare Workers and DDNS-style hosts rather than publisher-owned infrastructure, with no integrity verification or signing.
This incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-q3rw-pp75-vcx6.
Indicators of compromise
- Packages
- devplatform-spa-plugin-feature-toggle@35.7.4
- Domains
- *.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately remove devplatform-spa-plugin-feature-toggle@35.7.4 from all projects and dependency trees
- Audit package-lock.json and yarn.lock files for any installations of the affected version
- Scan systems that installed this package for unexpected binaries in /var/tmp/.cache_ (Unix) or %TEMP%/dotnet_diag_.exe (Windows)
- Review process execution logs and network connections from the time of installation for suspicious activity
- Update to a patched version if available, or replace with an alternative feature-toggle library
- Implement npm package pinning and integrity verification in CI/CD pipelines
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-q3rw-pp75-vcx6 · GitHub Advisory Database
Cite this entry
"Malicious code in devplatform-spa-plugin-feature-toggle (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-devplatform-spa-plugin-feature-toggle-npm-wojkpn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit