{"schema_version":"1.8.0","id":"MAL-2026-12715","published":"2026-08-05T13:49:48Z","modified":"2026-08-05T14:36:38.826635896Z","summary":"Malicious code in devplatform-iam-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f)\nThe package presents a no-op DevplatformIamClient export, but index.js unconditionally require()s./_init.js on load. _init.js selects a platform-specific path, reconstructs Cloudflare Workers endpoints from split string arrays (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) and a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru (base64 chunks reassembled from TXT records), downloads an opaque binary, writes it to a disguised path (/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed. Endpoint hostnames are assembled at runtime via array-join to evade static extraction, and the staged file names ('.analytics_state', 'dotnet_diag_*.exe') act as cover. The package name, 'Internal devplatform iam client module' description, empty dependencies, and stub main are consistent with a dependency-confusion lure against an internal registry name; the harm is full-host code execution on the installer at require() time.\n","affected":[{"package":{"name":"devplatform-iam-client","ecosystem":"npm","purl":"pkg:npm/devplatform-iam-client"},"versions":["35.5.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"10ea19c962b4e0138d5cd30ac4209bc54df31178ea4b701d5845456dd639946d","tlsh":"64b1a79a15663019cbb0d7f487174416f69be6633380c2d8fa9ca5940fb217483b1efc"},{"path":"package.json","sha256":"bb10cd6f9227521c2950b810945e82c2cde5264a0a5fba5ccc29275bf00602c3","tlsh":"68d0a73206719a3301b953a36cd1811737b20f1f6062ed4e72b7114c01ea465019d331"}],"package_integrity":[{"filename":"devplatform-iam-client-35.5.6.tgz","hashes":{"sha1":"e8ae4b32acf29b7768566586db9df86f58c8d2c9","sha512_sri":"sha512-Z8NpunbSJPy/mCbj198DwVX8P3BstreMZRkz4D5pCi3IlVOJw4ShS5XxOGWth4l3ypJ/6rDBz6W/coK5/G0jWA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-iam-client/MAL-2026-12715.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-iam-client/v/35.5.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015056","import_time":"2026-08-05T14:19:57.301021244Z","modified_time":"2026-08-05T13:49:48Z","sha256":"494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f","source":"amazon-inspector","versions":["35.5.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}