{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "setup.js",
              "sha256": "0189046bc2ea2c4749406de5aa13bc6cddeee8647d7a1226f6c08848311b1dd3",
              "tlsh": "f8a1859612aa70294bb09bf4c6175416f657f6633780c2d8fb9ca9941f72124c3b2efc"
            },
            {
              "path": "lib/telemetry.js",
              "sha256": "8b66dccd5b86f01dcdb10862e056b838dc8489b80726f29febb3e74d63295036",
              "tlsh": "01835055566a242186b2b368df234007ff3685272643429dbafc82dc1fbd72092a5ffc"
            }
          ],
          "package_integrity": [
            {
              "filename": "delivery-ci-core-35.3.7.tgz",
              "hashes": {
                "sha1": "3379b1a34916f52c890da833be7f1a95c5e8f19a",
                "sha512_sri": "sha512-qjrHE6oZfXiZj4A0mAj7ytog+RP9uoedmEjmGnb327+8PBj83XyIedVkswFerSA2plo02ye+juOxhSqCrKdWkQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "delivery-ci-core"
      },
      "versions": [
        "35.3.7"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017025",
        "import_time": "2026-08-07T12:51:22.737198355Z",
        "modified_time": "2026-08-07T12:32:53Z",
        "sha256": "8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335",
        "source": "amazon-inspector",
        "versions": [
          "35.3.7"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335)\nindex.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) from split string arrays, with a DNS TXT-record fallback under *.dl.wel1.ru that base64-reassembles the payload. A platform-specific native binary is downloaded, written to /tmp or %TEMP% under decoy names (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Dangerous API and module names are obfuscated by string splitting (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade static inspection. lib/telemetry.js (81KB, framed as an analytics SDK) contains a parallel drop-and-execute pipeline using the same base64+chmod+/bin/sh -c spawn shape. Installing or importing this package causes execution of attacker-controlled native code on the installer\u0027s host with no user interaction beyond require().\n",
  "id": "MAL-2026-13540",
  "modified": "2026-08-07T12:32:53Z",
  "published": "2026-08-07T12:32:53Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/delivery-ci-core/v/35.3.7"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in delivery-ci-core (npm)"
}