OpenSSF/OSV advisory MAL-2026-12781 confirms this npm version as malicious. index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf101-adf, cf99-9b3, cf100-416) with DNS-TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or a Windows temp path named...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in devplatform-spa-plugin-suspense (npm)
Details
index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf101-adf, cf99-9b3, cf100-416) with DNS-TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or a Windows temp path named dotnet_diag_<hex>.exe, chmod'd 0o755, and detached-spawned via /bin/sh -c or cmd.exe /c start. Hostnames and dangerous API names (child_process, chmodSync) are reconstructed from split literal arrays to evade static analysis, and there is no hash or signature verification of the downloaded payload. A second implementation of the same download-chmod-spawn pattern is present in lib/telemetry.js (~81KB), framed as an 'Analytics SDK', though it is not reached from the current main entry. Executing require() on this package causes attacker-controlled native code to run on the installer's machine.
Decision reason
OpenSSF Malicious Packages via OSV confirms devplatform-spa-plugin-suspense@35.6.2 as malicious (MAL-2026-12781): Malicious code in devplatform-spa-plugin-suspense (npm)