🛡️ MAL-2026-12718 — devplatform-jscodeshift-transforms

Malicious code in devplatform-jscodeshift-transforms (npm)

Source: amazon-inspector

On require() of the package, index.js loads _shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (destinations reconstructed via string-split concatenation such as ["oob-worker.cf102-b","af.workers.","de","v"].join("")), writes it to /var/tmp or %TEMP% under disguised names like dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. When HTTPS retrieval fails, _shim.js falls back to a DNS-TXT covert channel: it resolves TXT records on numbered subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-reassembles the responses into the executable buffer. API names (require("child_" + "process"), fs["chmod" + "Sync"]) are likewise split to evade static analysis, and env-var checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) plus cover-story identifiers (analytics_state, telemetry.js) frame the loader as benign analytics. The package name mimics an internal jscodeshift transforms wrapper.