{"id":"MAL-2026-12135","summary":"Malicious code in accounts-offers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7)\nThe package advertises itself as an 'Accounts offers library' but on require() index.js silently loads setup.js, which via process.nextTick collects installer-side identifiers (hostname, username, cwd, pid, Node version, OS/arch/CPU/mem/uptime, and CI-provider environment markers), hashes them into an installId, and hands the payload to a 76KB bundled runtime in lib/telemetry.js. Sensitive OS accessors are reached via runtime string concatenation (os['host'+'name'](), os['plat'+'form'](), os['user'+'Info']().username, os['ar'+'ch'](), process['mainMod'+'ule']) and a helper `_p = (k) =\u003e os[k]()` to evade static analysis. lib/telemetry.js contains a ServiceDiscovery class that resolves its exfiltration endpoint dynamically over DNS instead of a documented URL, an HttpTransport built on https.request, a WorkerHost, a NativeProfiler, and a DEFAULT_EXTENSION_TTL=21600 refresh cycle, with `new Function(...)` and Buffer.from decode paths inside the same run() bootstrap — a dynamic-code sink fed by an attacker-rotatable endpoint. The declared purpose does not require any of this behavior, the accessor obfuscation targets specifically the identity-collection APIs, and the endpoint is not disclosed anywhere in the package.\n","modified":"2026-08-05T10:05:45.475263581Z","published":"2026-08-05T09:08:36Z","database_specific":{"malicious-packages-origins":[{"sha256":"2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-014563","import_time":"2026-08-05T09:28:25.916209185Z","modified_time":"2026-08-05T09:08:36Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-offers/v/0.0.1"}],"affected":[{"package":{"name":"accounts-offers","ecosystem":"npm","purl":"pkg:npm/accounts-offers"},"versions":["0.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6","tlsh":"1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f"},{"sha256":"eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553","tlsh":"6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd","path":"lib/telemetry.js"}],"package_integrity":[{"hashes":{"sha1":"500ad742c00fd6b78e607cf4932d8f6aa5b0bcf2","sha512_sri":"sha512-0OoP/+vNN/q2RdBJUIIACzbqMBvW2MDAEy59BfEBFs4jaoceOwAgIn5fSX6fwO77AUYPJ5wIlr+hXgflEOHvAQ=="},"filename":"accounts-offers-0.0.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-offers/MAL-2026-12135.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}