devplatform-spa-plugin-authnpm
Advisory published Updated
devplatform-spa-plugin-auth is a confirmed malicious npm package (MAL-2026-12761) that executes malicious code on install (malicious version 35.4.5). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in devplatform-spa-plugin-auth (npm)
What this malware does
The package's main entry loads helpers.js which auto-invokes a start() routine on require. That routine selects a platform-specific asset path, retrieves an opaque native binary over HTTPS from one of four Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT base64-chunk fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh or cmd.exe. Hostnames and sensitive API references are assembled at runtime from string arrays (['oob-worker.cf100','-416.workers.de','v'].join(''); require('child_'+'process')), a '.analytics_state' marker file suppresses repeat runs, and stderr is silenced through a no-op writer. The package is advertised as an SPA auth-token plugin and has no legitimate reason to fetch and execute a native binary at load time. The delivered code is attacker-controlled and unverified, granting full-host code execution to whoever operates the Workers/DNS infrastructure on any machine that requires this module.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for devplatform-spa-plugin-auth (version 35.4.5).
If you installed it — respond
Remove devplatform-spa-plugin-auth from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If devplatform-spa-plugin-auth was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks devplatform-spa-plugin-auth-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.