{"schema_version":"1.8.0","id":"MAL-2026-13275","published":"2026-08-05T15:28:50Z","modified":"2026-08-05T16:50:28.992628188Z","summary":"Malicious code in devplatform-zod-wip-api (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492)\ndevplatform-zod-wip-api@35.9.3 is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally requires./_vendor on load; _vendor.js runs at module load, reassembles a C2 hostname from split string fragments (oob-worker.cf99-9b3.workers.dev) with a DNS-TXT-record fallback to sdk.dl.wel1.ru, fetches a platform-specific native binary over HTTPS, writes it to /var/tmp/.cache_<uid> on Unix or %TEMP%\\dotnet_diag_<uid>.exe on Windows, chmods it 0755, and detached-spawns it via /bin/sh -c \"<path> &\" or cmd start /b. There is no signature or hash verification of the fetched bytes. A marker file at.analytics_state/analytics_state gates re-execution to roughly a 6-hour interval. A second parallel dropper implementation is shipped in lib/telemetry.js (assembles base64 chunks over DNS TXT, writes an 'extension' file, chmods 755, spawns /bin/sh). Hostname reassembly via.join(''), split-string obfuscation of DNS resolvers, and hidden filenames masquerading as OS cache/diagnostics files (.cache_, dotnet_diag_) indicate deliberate evasion rather than telemetry. On any require() of this package, arbitrary attacker-controlled native code executes on the installer's host.\n","affected":[{"package":{"name":"devplatform-zod-wip-api","ecosystem":"npm","purl":"pkg:npm/devplatform-zod-wip-api"},"versions":["35.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"9ef40e31d9244064ef8c92a6d33f38fe6bfcf724a449033522aac18b3a2d2da1","tlsh":"dfa1635a16a670194bb0d7e487174416f65bf6a33380c694fb9ca9940f7362483b2efc"},{"path":"lib/telemetry.js","sha256":"29e987cbfdc0a7d02e3256d253afb82cdfe5bb8db5983d60edcea4c03f05ffb5","tlsh":"de835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"devplatform-zod-wip-api-35.9.3.tgz","hashes":{"sha1":"cc196d9cf6af92be3638fe2fd79e0abe17a80305","sha512_sri":"sha512-5L8zaKL4eIMnGVO3EpvC47qllc34+9yfQ8dYkpbvGwD31+huplFCn04nEKCe4J0/W6sk0xX4VgOvQFSbOeRGsA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/devplatform-zod-wip-api/MAL-2026-13275.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/devplatform-zod-wip-api/v/35.9.3"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015714","import_time":"2026-08-05T16:13:35.380306343Z","modified_time":"2026-08-05T15:28:50Z","sha256":"2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492","source":"amazon-inspector","versions":["35.9.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}