Malicious code in devplatform-spa-plugin-ability (npm)

__

Source: amazon-inspector (c9753b327ec0ed7c7cf204951dd0c1db47db31c79fde8ffad042e8658bb0dc81)

On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (chunk count in c., N shards concatenated and base64-decoded into an executable buffer). Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf102-baf.worke","rs.d","ev"].join("")). The fetched binary is written to disguised paths (/var/tmp/.cache, %TEMP%\dotnet_diag_.exe, /pkg/package.exe|-arm64|loader_mac), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start with no hash or signature verification. A lib/telemetry.js decoy file and an.analytics_state rate-limit stamp plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env-var gates provide cover-story framing; the delivered payload is unrelated to the package's stated purpose (an "SPA plugin ability SDK"). Installing or requiring this package executes attacker-controlled code on the installer host.