Which versions of devplatform-nx-husky are malicious?

The following npm versions of devplatform-nx-husky are flagged malicious: 35.7.7. Treat any of these as compromised.

How do I remediate devplatform-nx-husky if I installed it?

devplatform-nx-husky is a typosquat — you almost certainly intended a legitimately-named package. Remove devplatform-nx-husky, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed devplatform-nx-husky — how do I know if it already compromised me?

If devplatform-nx-husky was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is devplatform-nx-husky part of a known attack campaign?

Yes — devplatform-nx-husky is associated with the IN-MAL-2026-015046, GHSA-3q8c-jjq8-86cf campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find devplatform-nx-husky across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for devplatform-nx-husky (version 35.7.7).

Malicious package

devplatform-nx-huskynpm

Advisory published Aug 5, 2026Updated Aug 6, 2026

devplatform-nx-husky is a confirmed malicious npm package (MAL-2026-12724) that typosquats a legitimate package to trick installs (malicious version 35.7.7). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in devplatform-nx-husky (npm)

MAL-2026-12724

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall devplatform-nx-husky

What this malware does

devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate functionality. On require(), vendor.js selects a per-platform payload path and fetches an executable from one of four Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev). If HTTPS delivery fails, it falls back to a DNS TXT covert channel under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reading a chunk count from a c.<domain> TXT record and reassembling base64 TXT chunks into the payload. The bytes are written to /var/tmp (or %TEMP% on Windows) under an inconspicuous name, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. Destination hostnames and the child_process/chmodSync API names are reassembled at runtime from split-string arrays (e.g. ["oob-worke","r.cf102-baf.","work","ers.dev"].join(""), require("child"+"process"), fs["chmod"+"Sync"]) to evade static detection. A second copy of the fetch-decode-chmod-spawn dropper is bundled in lib/telemetry.js under an 'Analytics SDK' cover story.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

35.7.7

Indicators of compromise (SHA-256)

0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d

bbf7609632af8a7f80ad4e0c4ba1cf57436d4d55d3f60377d6ea91e2fa1ed2ac

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for devplatform-nx-husky (version 35.7.7).
If you installed it — respond
devplatform-nx-husky is a typosquat — you almost certainly intended a legitimately-named package. Remove devplatform-nx-husky, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If devplatform-nx-husky was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. devplatform-nx-husky on npm has been identified as a malicious package (version 35.7.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015046GHSA-3q8c-jjq8-86cf

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks devplatform-nx-husky-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database