🛡️ MAL-2026-13265 — devplatform-supafetch

Malicious code in devplatform-supafetch (npm)

Source: amazon-inspector

[email protected] is advertised as a fetch helper but on require() drops and executes an opaque native binary. index.js unconditionally loads./_ext.js, which selects a platform-specific payload path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), downloads it from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev), with a DNS-TXT fallback channel over subdomains of *.dl.wel1.ru that reassembles a base64-encoded payload from split TXT records. The downloaded bytes are written to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and launched detached via spawn("/bin/sh", ["-c", fp+" &"]).unref() (or the cmd equivalent on Windows). Host names and DNS-fallback domain segments are constructed via ["...","..."].join("") to defeat static string matching. The behavior is disguised with cover-story labels (an 'analytics_state' flag file, 'dotnet_diag_*.exe' filename, gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars) that make the dropper appear to be optional telemetry. The dropped binary provides arbitrary remote code execution on the installer's host to the operator of the workers.dev / wel1.ru infrastructure.