devplatform-sdk

Details

**Severity:** Critical

**Affected versions:** `= 35.6.1`

## Source: amazon-inspector (c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c)
On require('devplatform-sdk'), index.js loads _polyfill.js which auto-invokes start(): it selects a per-OS payload path, fetches a binary from string-concatenated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it under /var/tmp or %TEMP% with a camouflaged name (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmods 0o755, and detached-spawns it via /bin/sh -c or cmd /c start /b. Evasion features accompany the drop-and-run: hostnames assembled from split fragments via.join(''), the dropped binary renamed to look like a system cache/diagnostic file, a mtime-based stamp file at /tmp/.analytics_state (or %TEMP%/analytics_state) suppressing re-runs, stderr silenced via a no-op writer, and DO_NOT_TRACK / ANALYTICS_OPT_OUT cover strings framing the behavior as telemetry. The package advertises itself as a lightweight SDK wrapper; the load-time behavior is a binary dropper delivering arbitrary attacker-controlled native code to the installer.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/78792aee23e5c759f309a3d2e9397caf2439773e/osv/malicious/npm/devplatform-sdk/MAL-2026-12750.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/78792aee23e5c759f309a3d2e9397caf2439773e/osv/malicious/npm/devplatform-sdk/MAL-2026-12750.json
- https://www.npmjs.com/package/devplatform-sdk/v/35.6.1
- https://github.com/advisories/GHSA-8q3j-2gv8-r5h5

Compromised versions (1)

• = 35.6.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.