docflow-cryptopro@35.1.6: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 10d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13279 confirms this npm version as malicious. On require of the package's main, _platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains (hostnames assembled from split string fragments such as ['oob-worke','r.cf102-baf.workers','.d','ev']) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered TXT records under c.*.dl.wel1.ru...

Advisory

MAL-2026-13279

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in docflow-cryptopro (npm)

Details

On require of the package's main, _platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains (hostnames assembled from split string fragments such as ['oob-worke','r.cf102-baf.workers','.d','ev']) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered TXT records under c.*.dl.wel1.ru. The binary is written to a temp path under a decoy name (e.g. dotnet_diag_*.exe,.cache_*), chmod +x is applied on POSIX, and it is spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Execution is gated by an 'analytics_state' marker and opt-out env-var checks that function as cover for the drop. The advertised purpose is 'cryptographic primitives', which does not match downloading and executing an unverified native binary from workers.dev hosts. The package name (docflow-cryptopro) resembles the CryptoPro / КриптоПро brand family and is not affiliated with that vendor.

Decision reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.7 KB of source

Source & flagged code

5 flagged

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

491L492: fork() { L493: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L491

•matchType = normalized_sha256 matchedPackage = devplatform-spa-plugin-router@35.5.3 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:35.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

_platform.jsView file

6Trigger-reachable chain: manifest.main -> index.js -> _platform.js L6: const fs = require("fs"); L7: const https = require("https"); L8: ... L45: const MAX_AGE = 21715; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_platform.jsView on unpkg · L6

Source & flagged code

5 flagged · loading source

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

491L492: fork() { L493: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L491

•matchType = normalized_sha256 matchedPackage = devplatform-spa-plugin-router@35.5.3 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:35.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Findings

2 Critical2 High2 Medium2 Low

CriticalDownload Executelib/telemetry.js

CriticalTrigger Reachable Dangerous Capability_platform.js

HighChild Processlib/telemetry.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowWeak Cryptolib/telemetry.js

LowFilesystem