dippy-invertor @35.1.6
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 4:49 AM UTC
OSV ID
MAL-2026-13276
Ecosystem
npm
Summary
On require('dippy-invertor') , index.js unconditionally loads _ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers hosts (oob-worker.cf10*.workers.dev family) and, on HTTPS failure, falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (queries TXT at c.<domain> for a chunk count, iterates 0.<domain> .. N.<domain> , base64-decodes the concatenation). The retrieved payload is written to /tmp or %TEMP% under a disguised name ( .cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached and unref'd via /bin/sh -c or cmd . Hostnames and the child_process / chmodSync API names are split-concatenated ( [...].join('') ) to evade string scanning, and cover-story identifiers ( analytics_state , DISABLE_TELEMETRY , dotnet_diag_*.exe ) disguise the loader. The package has no legitimate advertised behavior that requires fetching and executing an opaque remote binary at load time.
Source: amazon-inspector (e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.