{"id":"MAL-2026-12137","summary":"Malicious code in accounts-timeline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df)\nOn require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on OS/arch, setup.js selects one of /pkg/package, /pkg/package.exe, /pkg/loader_mac, or /pkg/package-arm64 and invokes lib/telemetry.js runtime.run(), which fetches bytes from hardcoded remote endpoints, base64-decodes them, writes them to /var/tmp (or %TEMP% on Windows), chmods 0755, and executes the resulting binary. The destination hostnames (package-proxy.cf5oob.workers.dev, package-proxy.cf8oob.workers.dev, package-proxy.cf12oob.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev, and tin/tina/ldr/win subdomains of dl.well1.site) are assembled at runtime from split-string arrays via.join(\"\"), and sensitive API names (child_process, fs.chmodSync, os.hostname, os.platform) are reassembled from property-name concatenation to evade static analysis. setup.js additionally computes an installFingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid, sha256-hashes it, and passes it as installId in the fetch request, causing installer host identifiers to be transmitted to the same attacker-controlled endpoints. The package presents itself as an accounts SDK and has no legitimate need for a platform-branched binary fetch-decode-chmod-exec pipeline pointed at anonymous Cloudflare Workers subdomains.\n","modified":"2026-08-05T10:05:46.409810944Z","published":"2026-08-05T08:50:09Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["9.6.9"],"id":"IN-MAL-2026-014562","import_time":"2026-08-05T09:28:25.827562208Z","modified_time":"2026-08-05T09:08:28Z","sha256":"06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df"},{"modified_time":"2026-08-05T09:08:21Z","sha256":"974138e46cacbcbfb8e2c741afdd2e447d60ec327bfb290c19ede3717f857e8a","source":"amazon-inspector","versions":["9.6.10"],"id":"IN-MAL-2026-014561","import_time":"2026-08-05T09:28:25.73875336Z"},{"source":"amazon-inspector","versions":["9.6.11"],"id":"IN-MAL-2026-014560","import_time":"2026-08-05T09:28:25.654211016Z","modified_time":"2026-08-05T09:08:12Z","sha256":"0db1a3a62db9be6db76099dec022af0991f32c738f46ad8b47c4e09fcf4f2bfb"},{"sha256":"0e3a0b0d3a2f92d7c7085811561a7a87ecd3dca2779934f7c6f0672c88d3f3c1","source":"amazon-inspector","versions":["9.6.12"],"id":"IN-MAL-2026-014436","import_time":"2026-08-05T09:28:10.82348051Z","modified_time":"2026-08-05T08:50:09Z"},{"versions":["12.3.7"],"id":"IN-MAL-2026-014559","import_time":"2026-08-05T09:28:25.560311029Z","modified_time":"2026-08-05T09:08:04Z","sha256":"2e6985bcd929a499e10c5ea64ba66c7b67eef3a7d6c7e5a3409818e53b996927","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-timeline/v/9.6.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-timeline/v/9.6.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-timeline/v/9.6.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-timeline/v/9.6.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-timeline/v/12.3.7"}],"affected":[{"package":{"name":"accounts-timeline","ecosystem":"npm","purl":"pkg:npm/accounts-timeline"},"versions":["9.6.9","9.6.10","9.6.11","9.6.12","12.3.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"44d13ca192133d1e1bb3c0dad1695c5167c4284e9789163c5347c821f267653e","tlsh":"519164084ed525250298e3f9296a4447e89614537ac8f248ba4ff2589f98138877ffbe"}],"package_integrity":[{"filename":"accounts-timeline-9.6.9.tgz","hashes":{"sha1":"dddabb2a00c76c6a9bac4e751964f6fe4db515a1","sha512_sri":"sha512-uxvaNT6sQYCNEMgxh0i4A1JBeJfPZTM7tcomSFgIUEdpMw2Loer9Ff71+7SlETK1WDccE94hECPZSD/H5UUN3Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-timeline/MAL-2026-12137.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}