devplatform-jscodeshift-transforms @35.9.5
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12718
Ecosystem
npm
Summary
On require() of the package, index.js loads _shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (destinations reconstructed via string-split concatenation such as ["oob-worker.cf102-b","af.workers.","de","v"].join("")), writes it to /var/tmp or %TEMP% under disguised names like dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. When HTTPS retrieval fails, _shim.js falls back to a DNS-TXT covert channel: it resolves TXT records on numbered subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-reassembles the responses into the executable buffer. API names (require("child_" + "process"), fs["chmod" + "Sync"]) are likewise split to evade static analysis, and env-var checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) plus cover-story identifiers (analytics_state, telemetry.js) frame the loader as benign analytics. The package name mimics an internal jscodeshift transforms wrapper.
Source: amazon-inspector (37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.