Malicious code in devplatform-spa-plugin-module (npm)

__

Source: amazon-inspector (638c4246220ea7f9a595c145c76940e7e060920ef251ab2c67ca814b9ab93378)

On require of the package's main entry, polyfill.js executes init() which reconstructs destination hostnames via array-join string splits (e.g. ["oob-worke","r.cf100-416.worker","s.","dev"].join("")), selects a platform-specific endpoint, downloads an opaque binary via https.get from one of several Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev), writes the payload to /tmp or %TEMP% under a disguised name (.cache on Unix, dotnet_diag_.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true,stdio:"ignore"}).unref() or spawn("cmd",...). If HTTPS retrieval fails, a fallback path resolves TXT records at c. and iteratively at N. under *.dl.wel1.ru (sdk/ext/pkg/net subdomains), base64-concatenates the chunks, and treats the result as the executable payload. Host reconstruction, disguised file names, staging in temp directories, detached execution, and a DNS TXT covert-channel fallback together constitute a fully productionized install-time dropper delivering arbitrary attacker code to any machine that installs or requires this package.