{"id":"MAL-2026-12412","summary":"Malicious code in pfp-forms-independent-sme-glossary-anchor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c96f28993eb59bb78a357534cf64aac001732fc4951ccb33f8eca2a3ce615f3c)\nOn require of the package, index.js loads _compat.js which reconstructs mirror hostnames via string-splitting joins (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev) with a DNS TXT-record fallback under *.dl.well1.site, fetches a platform-specific binary via https.get, writes it to a disguised path under /var/tmp or %TEMP% (e.g..cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. A second equivalent dropper is bundled in lib/telemetry.js (Buffer.from(chunks,'base64'), chmodSync 0o755, cp.spawn('/bin/sh',['-c',filePath+' &'])) as an alternate staging path. Hostname reconstruction via array-join fragments and library-load-time execution place this outside legitimate native-binary install patterns.\n","modified":"2026-08-05T13:35:43.471852621Z","published":"2026-08-05T12:35:16Z","database_specific":{"malicious-packages-origins":[{"versions":["20.4.4"],"id":"IN-MAL-2026-014717","import_time":"2026-08-05T13:08:40.3218121Z","modified_time":"2026-08-05T12:35:16Z","sha256":"c96f28993eb59bb78a357534cf64aac001732fc4951ccb33f8eca2a3ce615f3c","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pfp-forms-independent-sme-glossary-anchor/v/20.4.4"}],"affected":[{"package":{"name":"pfp-forms-independent-sme-glossary-anchor","ecosystem":"npm","purl":"pkg:npm/pfp-forms-independent-sme-glossary-anchor"},"versions":["20.4.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pfp-forms-independent-sme-glossary-anchor/MAL-2026-12412.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"58874f3a8d5ee5ea071996c585135c18ce68366d0300104d48f6137fc0c73908","tlsh":"5ea1a65616aa701d87f09be4cb175415f65ff2633380c298fb9c69885f7216482b2efc"},{"path":"lib/telemetry.js","sha256":"d1d7fae5f4f461cd013809ece27eae362879e8b72dfd1a73c9460d4c188e0733","tlsh":"d9835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"pfp-forms-independent-sme-glossary-anchor-20.4.4.tgz","hashes":{"sha1":"12e0c75fc91c0c55be47324b3838a5f5c0ad5823","sha512_sri":"sha512-QGTGWb08WuD7+KFaZrx/qe4m+F6gnlRSzoLdpzOf580Xjcx0XRkjQApt3XPKnmEawqPf7JBEEaJfxN+bNivmXQ=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}