{"answers":{"affected":"1 open source package ship an affected version, including ded-pwa-test-pub-pkg.","exploited":"There is no known exploitation of MAL-2026-13537 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13537 is a malicious package in ded-pwa-test-pub-pkg, published on 7 Aug 2026."},"fix_prompt":"MAL-2026-13537 is a malicious package: ded-pwa-test-pub-pkg (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13537/ (Markdown: https://insights.sbomify.com/MAL-2026-13537/index.md)","id":"MAL-2026-13537","markdown":"https://insights.sbomify.com/MAL-2026-13537/index.md","name":"MAL-2026-13537","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On module load, index.js requires./_compat.js which assembles remote hostnames from split string literals (e.g. [\"oob-worker.cf1\",\"00-416.w\",\"orkers\",\".dev\"].join(\"\") and additional *.workers.dev variants) plus a DNS-TXT fallback under *.dl.wel1.ru, fetches a platform-specific binary via https.get, writes it to a disguised path in /tmp or %TEMP% (.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe), chmods it 0755, and spawns it detached via spawn(\"/bin/sh\",[\"-c\", path+\" \u0026\"], {detached:true}) or spawn(\"cmd.exe\",[\"/c\",\"start\",\"/b\", path]). A stamp file at /tmp/.analytics_state gates re-execution and environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked to skip execution in likely analysis environments. Log calls are stubbed to write empty strings. The destination hostnames are anonymous, mutable CDN endpoints unrelated to any documented package purpose; the delivered bytes are opaque and run with the installer's privileges.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in ded-pwa-test-pub-pkg (npm)","id":"MAL-2026-13537","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"ded-pwa-test-pub-pkg","purl":"pkg:npm/ded-pwa-test-pub-pkg","source":"MAL-2026-13537"}],"products":null,"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13537/"}