devplatform-hooksnpm
Advisory published Updated
devplatform-hooks is a confirmed malicious npm package (MAL-2026-12711) that executes malicious code on install (malicious version 35.2.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in devplatform-hooks (npm)
What this malware does
On require() of devplatform-hooks, index.js loads init.js, which selects a platform-specific payload URL and fetches an executable from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev). The destination hostnames are assembled at runtime from split string fragments joined together to evade static inspection. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel: it queries c.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru for a chunk count, iteratively resolves N.<domain> TXT records, concatenates and base64-decodes the responses into a binary. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmod 0755, then executed detached via cp.spawn("/bin/sh", ["-c", path+" &"], {detached:true}) or the Windows equivalent. The package name, the obfuscation of destinations, the DNS-TXT covert transport, the disguised drop paths, and the detached execution together constitute a remote code execution dropper triggered on any install or import of this package.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for devplatform-hooks (version 35.2.1).
If you installed it — respond
Remove devplatform-hooks from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If devplatform-hooks was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks devplatform-hooks-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.