Malicious code in devplatform-spa-tokens (npm)

__

Source: amazon-inspector (6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a)

On require(), index.js loads support.js, which assembles Cloudflare Workers hostnames (oob-worker.cf*.workers.dev) and fallback domain sdk.dl.wel1.ru at runtime from split string arrays joined via.join(""), downloads a platform-specific binary from those hosts (with a DNS TXT chunked fallback via c./i. records when HTTPS is blocked), writes the payload to a temp path with a disguised name (e.g. dotnet_diag.exe,.cache_), chmods 0755 on POSIX, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). Execution is gated by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars and a /tmp/.analytics_state cache, framing the dropper as analytics. The advertised TokenManager API is a decoy — no relation to the download-and-execute behavior. Destination hosts are anonymous workers.dev / lookalike infrastructure, not the package's stated purpose or publisher.