Malicious code in devplatform-spa-plugin-module-loader (npm)

__

Source: amazon-inspector (902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8)

On require, index.js unconditionally loads platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback that reassembles base64 chunks from subdomains of dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache on Unix or %TEMP%\dotnet_diag_.exe on Windows, chmod 0755, and detached-spawned via cp.spawn('/bin/sh', ['-c', fp+' &']) or the Windows equivalent. Destination hostnames and the child_process API name are assembled by joining split string fragments (e.g. ['sdk.','dl.wel1.','ru'].join('')); dropped-file names mimic legitimate cache/diagnostic paths; cover-story comments reference SHA-256 integrity checks and rate limiting with no matching code; an opt-out env var (DISABLE_TELEMETRY) frames the behavior as analytics. The workers.dev destinations are anonymous, mutable, and unrelated to any legitimate publisher of a module-loader package.