{"id":"MAL-2026-12295","summary":"Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036)\nOn require of the package's main index.js, _support.js reconstructs attacker-controlled hostnames from string-split arrays (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback under dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache_\u003chex\u003e on Unix or %TEMP%/dotnet_diag_\u003chex\u003e.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed. Filenames and lock paths (analytics_state, dotnet_diag_*.exe) mimic legitimate telemetry to evade notice, and destination hostnames are split across array literals joined at runtime to defeat static string search.\n","modified":"2026-08-05T10:07:04.998557497Z","published":"2026-08-05T09:09:12Z","database_specific":{"malicious-packages-origins":[{"sha256":"421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036","source":"amazon-inspector","versions":["20.6.9"],"id":"IN-MAL-2026-014567","import_time":"2026-08-05T09:28:26.32056189Z","modified_time":"2026-08-05T09:09:12Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/twork-data-services-procedure-engine-api-v1-procedure-info/v/20.6.9"}],"affected":[{"package":{"name":"twork-data-services-procedure-engine-api-v1-procedure-info","ecosystem":"npm","purl":"pkg:npm/twork-data-services-procedure-engine-api-v1-procedure-info"},"versions":["20.6.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-procedure-engine-api-v1-procedure-info/MAL-2026-12295.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"twork-data-services-procedure-engine-api-v1-procedure-info-20.6.9.tgz","hashes":{"sha1":"5f3ebf4d7909f9f6f13bbd26037471404b1c1c83","sha512_sri":"sha512-iDOQkmh+CX5fKgaeOWn+U7IunEkFIibRDb9os5lH5IQE1xibDjZRd0CcTd1rRDW+9xUpH6uvPYtaHQpgcg89JA=="}}],"evidence_files":[{"path":"_support.js","sha256":"43fb8862df8bcbe69222e00fee7894e12d09ca830e7332a032acfa4cd8d87c3b","tlsh":"a4b1a69a057a30198bb09be58b075415fa5bf26377808284fb9cb5841f7302483b2efc"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}