{"id":"MAL-2026-12294","summary":"Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f)\nOn require(), index.js loads _adapter.js, which downloads a platform-specific binary from Cloudflare Workers hosts under oob-worker.cf10x-*.workers.dev assembled by array-join string concatenation, writes it to /var/tmp/.cache_\u003chex\u003e on Unix or %TEMP%\\dotnet_diag_\u003chex\u003e.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS retrieval fails, _adapter.js falls back to a DNS TXT covert channel resolving c.\u003cdomain\u003e and N.\u003cdomain\u003e under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, reconstructing a base64-encoded payload from the TXT records and executing it via the same write-and-spawn path. Endpoint hosts and DNS domains are built via array.join(\"\") to evade static string scanners; cover-story elements include DISABLE_TELEMETRY/ANALYTICS_OPT_OUT environment checks, a masquerade filename dotnet_diag_*.exe, and a.analytics_state marker file gating repeat runs. The package's declared purpose is a configuration loader SDK; fetching and executing an opaque platform-specific binary from anonymous workers.dev hosts on import does not correspond to any documented functionality.\n","modified":"2026-08-05T10:07:04.780694316Z","published":"2026-08-05T09:14:33Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T09:14:33Z","sha256":"1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f","source":"amazon-inspector","versions":["20.6.1"],"id":"IN-MAL-2026-014604","import_time":"2026-08-05T09:28:29.603875547Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config/v/20.6.1"}],"affected":[{"package":{"name":"twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config","ecosystem":"npm","purl":"pkg:npm/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config"},"versions":["20.6.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config/MAL-2026-12294.json","indicators":{"evidence_files":[{"sha256":"04063b3e80b16f581ed9368b1beea7757e6e40a5309627e806913643625fbc44","tlsh":"3ab1b96a126630184bb0d7e4c71b5816f55af66373908284fb9ca5d85ff312482b2ffc","path":"_adapter.js"}],"package_integrity":[{"filename":"twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config-20.6.1.tgz","hashes":{"sha1":"53f7bee6b701fe6dea7e00b94db8c7a82a54d017","sha512_sri":"sha512-DNYpTaa2jhN68p6XP2aiTrSd1iz4bpiUOTEtAxM7j3JkvZqd5BHwwOmY6l7KYBa+ObFykJNTTmiPvhUHFTDAKQ=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}