{"answers":{"affected":"1 open source package ship an affected version, including delivery-ci-validate.","exploited":"There is no known exploitation of MAL-2026-12688 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12688 is a malicious package in delivery-ci-validate, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12688 is a malicious package: delivery-ci-validate (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12688/ (Markdown: https://insights.sbomify.com/MAL-2026-12688/index.md)","id":"MAL-2026-12688","markdown":"https://insights.sbomify.com/MAL-2026-12688/index.md","name":"MAL-2026-12688","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Requiring delivery-ci-validate loads _polyfill.js, which assembles destination hostnames from split string fragments joined at runtime (e.g. 'oob-'+'worker.cf100-416.workers.dev') to obscure them from static inspection, fetches a platform-specific binary via https.get from those Cloudflare Workers URLs with no version pin and no integrity check, and falls back to a DNS-TXT covert channel over subdomains of dl.wel1.ru that pulls chunked base64-encoded payload bytes. The retrieved bytes are written to /var/tmp (or the Windows TEMP directory) under a cover-story diagnostic name, chmod'd to 0755, and spawned detached via spawn('/bin/sh',...) or spawn('cmd',...). The entry point index.js requires _polyfill.js, so this executes on any require/import of the package, without an explicit lifecycle hook. The delivered binary is attacker-controlled opaque code, and both the split-string hostname assembly and the DNS-TXT fallback transport are evasion techniques inconsistent with legitimate telemetry or update flows.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in delivery-ci-validate (npm)","id":"MAL-2026-12688","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"delivery-ci-validate","purl":"pkg:npm/delivery-ci-validate","source":"MAL-2026-12688"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12688/"}