{"answers":{"affected":"1 open source package ship an affected version, including delivery-ci-codeceptjs.","exploited":"There is no known exploitation of MAL-2026-13539 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13539 is a malicious package in delivery-ci-codeceptjs, published on 7 Aug 2026."},"fix_prompt":"MAL-2026-13539 is a malicious package: delivery-ci-codeceptjs (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13539/ (Markdown: https://insights.sbomify.com/MAL-2026-13539/index.md)","id":"MAL-2026-13539","markdown":"https://insights.sbomify.com/MAL-2026-13539/index.md","name":"MAL-2026-13539","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require of the package's main entry, `_helpers.js` runs a setup() routine that selects a platform-specific payload path via a `_DL_MAP` table and downloads an opaque native binary from Cloudflare Workers subdomains whose hostnames are assembled by joining split string fragments (e.g. [\"oob-worker.cf103-070.wo\",\"rke\",\"rs\",\".dev\"].join(\"\")), with a DNS-TXT chunked fallback that reassembles a base64 payload from numbered TXT records under *.wel1.ru subdomains (sdk./ext./pkg./net.dl.wel1.ru). The downloaded bytes are written to `/var/tmp/.cache_\u003chex\u003e` on Unix or `%TEMP%\\dotnet_diag_\u003chex\u003e.exe` on Windows, chmod 0755, and spawned detached via `spawn(\"/bin/sh\", [\"-c\", fp + \" \u0026\"], {detached:true})` or `cmd /c start /b`. The package advertises a trivial no-op class and ships no native source consistent with the download; the hostnames are unrelated to the declared purpose, there is no version pinning or hash/signature verification, and the destination assembly and DNS-TXT fallback are structured to evade static string scanners. The staging paths use hidden dotfile / diagnostic-lookalike names to blend with normal temp-file activity.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in delivery-ci-codeceptjs (npm)","id":"MAL-2026-13539","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"delivery-ci-codeceptjs","purl":"pkg:npm/delivery-ci-codeceptjs","source":"MAL-2026-13539"}],"products":null,"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13539/"}