{"id":"MAL-2026-12293","summary":"Malicious code in twork-data-services-invest-box-account (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553)\nOn module load, index.js requires./_adapter.js which detects OS/architecture, fetches an opaque binary via https.get from string-concatenated Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and, on failure, reconstructs the payload from base64-encoded DNS TXT records under well1.site subdomains (tin/tina/ldr/win.dl.well1.site). The fetched bytes are written to /tmp or %TEMP% under masquerading names such as dotnet_diag_* and.cache_*, chmod 755'd on Unix, and spawned detached via spawn('/bin/sh', ['-c', path+' &']) or cmd.exe /c start /b on Windows. Hostnames are assembled via Array.join('') splits to defeat plain-string scanners. No hash or signature verification is performed, no publisher-matched host is used, and the delivered bytes are opaque. The package presents itself as a telemetry/analytics helper.\n","modified":"2026-08-05T10:07:03.819904814Z","published":"2026-08-05T09:13:11Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T09:28:28.737536039Z","modified_time":"2026-08-05T09:13:11Z","sha256":"ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553","source":"amazon-inspector","versions":["20.8.8"],"id":"IN-MAL-2026-014594"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/twork-data-services-invest-box-account/v/20.8.8"}],"affected":[{"package":{"name":"twork-data-services-invest-box-account","ecosystem":"npm","purl":"pkg:npm/twork-data-services-invest-box-account"},"versions":["20.8.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-invest-box-account/MAL-2026-12293.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"300ad59d56c388c7b229a0affee41d2fffd74b4d44aa46cd52b3787c7068dc92","tlsh":"81b186991666701887b0ebe4c7276415f557f66337808290f7aca9d81fb613883b2efc"}],"package_integrity":[{"filename":"twork-data-services-invest-box-account-20.8.8.tgz","hashes":{"sha1":"f41adf8d82957d9399249fa38732230cc03b72b2","sha512_sri":"sha512-qhGIBh/FK9u6sP7leICUrON40XvJw626VXG/s323m44XEbKbGH0CDncjLSdbp37MrMvD8/Oyx1HXKXbEz75egQ=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}