Malicious code in devplatform-stylelint-config (npm)
The npm package devplatform-stylelint-config contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package masqueraded as a stylelint configuration utility but included obfuscated payload delivery mechanisms via Cloudflare Workers and DNS-TXT exfiltration channels.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of the malicious package versions
- Ecosystems
- Attack vectors
- Affected entities
- devplatform-stylelint-confignpm package with malicious code in setup.js
The npm package devplatform-stylelint-config was published with a misleading description ("environment config reader") and a benign-looking ConfigLoader export, but its setup.js module—loaded automatically on require—contained malicious code.
The malicious setup.js assembled command-and-control hostnames from array joins to evade string-matching detection, including Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) and dl.wel1.ru subdomains (sdk, ext, pkg, net). It also implemented a DNS-TXT chunked base64 fallback channel for command delivery.
Upon execution, the code downloaded a platform-specific binary over HTTPS without hash or signature verification, wrote it to a hidden temporary path (/tmp/.cache_ on Unix or %TEMP%/dotnet_diag_.exe on Windows), made it executable, and spawned it in detached mode to run in the background.
The attack relied on package name/description mismatch and a cover-story gate variable ('analytics_state', 'DISABLE_TELEMETRY') to conceal the payload from casual inspection.
Indicators of compromise
- Packages
- devplatform-stylelint-config
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf103-070.workers.dev
- dl.wel1.ru
Remediation
- Immediately remove devplatform-stylelint-config from all projects and dependencies
- Audit npm install logs and lock files to identify when the package was installed
- Review and revoke any credentials or secrets that may have been exposed on affected systems
- Scan systems that installed this package for unauthorized binaries in /tmp/.cache_ (Unix) or %TEMP%/dotnet_diag_.exe (Windows)
- Monitor network traffic for connections to oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, or dl.wel1.ru subdomains
- Update npm package lock files and re-run clean installs from trusted sources
- Consider using npm audit and supply-chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-8m84-9859-q829 · GitHub Advisory Database
Cite this entry
"Malicious code in devplatform-stylelint-config (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-devplatform-stylelint-config-npm-11qwhi
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package