MAL-2026-11538

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eacq-payform-core/MAL-2026-11538.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11538
Published
2026-08-04T22:08:17Z
Modified
2026-08-04T23:05:02.859450981Z
Summary
Malicious code in eacq-payform-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724)

On require() of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime by joining split string fragments (e.g. "oob-worker.cf102-ba"+"f.w"+"orkers.dev"), with a DNS TXT chunked-base64 fallback channel (c.<domain> for chunk count, then N.<domain> TXT queries reassembled via Buffer.from(parts.join(""), "base64")). The fetched bytes are written under a disguised name (dot-file or dotnetdiag masquerade) in /var/tmp or %TEMP%, chmod 0o755 on POSIX, then detached-spawned via /bin/sh -c or cmd.exe. Package advertises itself only as a 'platform core' with no legitimate need for platform-detected binary execution. Host strings are deliberately fragmented to evade static analysis; a rate-limit marker is written to /tmp/.analyticsstate or %TEMP%\analyticsstate.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "20.3.6"
            ],
            "import_time": "2026-08-04T22:30:11.954600636Z",
            "sha256": "ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724",
            "id": "IN-MAL-2026-011346",
            "modified_time": "2026-08-04T22:08:17Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / eacq-payform-core

Package

Name
eacq-payform-core
View open source insights on deps.dev
Purl
pkg:npm/eacq-payform-core

Affected ranges

Affected versions

20.*
20.3.6

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "eacq-payform-core-20.3.6.tgz",
            "hashes": {
                "sha512_sri": "sha512-d3IeZd+bGdllFJu/TbrNwk52Ptvpa+/ysV1KGxmydHJjRmGHS/UxP7rM9dDJiM17nDxemtnH4+GC4d5g63GlJA==",
                "sha1": "c6e73e1993e084f5209706cba358d482a812cc7e"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "e5b175aa166630188bb0dbe8c6175415f65bf26373508294f79c65985ff312483b2efc",
            "sha256": "4be2c3767068e0f7eb80aa4457882ad2c1f2267c4dae493c91aa1b0e49b6659a",
            "path": "_vendor.js"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eacq-payform-core/MAL-2026-11538.json"