{"id":"MAL-2026-12475","summary":"Malicious code in tcb-web-copy-to-clipboard (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb)\nThe package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes over HTTPS from one of four runtime-assembled Cloudflare Workers hosts (with a TXT-record DNS fallback under dl.well1.site), writes the response to /var/tmp or %TEMP% under a disguised name (Unix:.cache_\u003chex\u003e; Windows: dotnet_diag_\u003chex\u003e.exe mimicking a Microsoft diagnostic tool), chmods 0755, and spawns it detached via /bin/sh -c '\u003cpath\u003e &'. Both the HTTPS hostnames and DNS domains are assembled by joining split string fragments (e.g. ['oob-worker.','cf101-','adf.workers.de','v'].join('')) to evade static string matching. A cover-story branch checks DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and writes a.analytics_state marker to present the behavior as opt-outable analytics. A companion lib/telemetry.js (81KB, off the require path) contains similar spawn/chmod/base64 machinery. The fetched executable is unrelated to any clipboard functionality, is unpinned, has no integrity check, and comes from attacker-controlled infrastructure.\n","modified":"2026-08-05T13:36:15.788459712Z","published":"2026-08-05T12:29:35Z","database_specific":{"malicious-packages-origins":[{"versions":["20.1.2"],"id":"IN-MAL-2026-014677","import_time":"2026-08-05T13:08:36.314480323Z","modified_time":"2026-08-05T12:29:35Z","sha256":"e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tcb-web-copy-to-clipboard/v/20.1.2"}],"affected":[{"package":{"name":"tcb-web-copy-to-clipboard","ecosystem":"npm","purl":"pkg:npm/tcb-web-copy-to-clipboard"},"versions":["20.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"7bd4b0ef1b99c97291a9ebe4b499b6139debced3c189b0f31d90eac943f8e456","tlsh":"d9a1b66a0665301887b0dbe4c7179415f65af65373808294fb9c65d85fb221883b2efc"}],"package_integrity":[{"filename":"tcb-web-copy-to-clipboard-20.1.2.tgz","hashes":{"sha1":"5727f76ee018b5ddd3228c326f9a537595db4add","sha512_sri":"sha512-gRW++1EuH9mD394XXd1lcM+YLRSVmnlk//8xWs+Q5XgDsvxiB5sB6W3OKrUUT+cTwrAuGzVaHMWdu3Pzqx/c/w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tcb-web-copy-to-clipboard/MAL-2026-12475.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}