MAL-2026-11550

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer/MAL-2026-11550.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11550
Published
2026-08-04T22:08:08Z
Modified
2026-08-04T23:05:41.284725346Z
Summary
Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8)

On require() of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT fallback channel over *.dl.well1.site (tin/tina/ldr/win.dl.well1.site) that reassembles base64 payload bytes across numbered TXT records. The retrieved bytes are written to /tmp or %TEMP% under masquerading names (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Hostnames are assembled from split-string fragments via.join(''); a stamp file named.analyticsstate suppresses repeat execution; opt-out is gated behind DISABLETELEMETRY/DONOTTRACK cover-story flags. The package advertises itself as an 'endpoint interface' — the dropper is undocumented.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-04T22:08:08Z",
            "sha256": "3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8",
            "id": "IN-MAL-2026-011345",
            "versions": [
                "20.5.3"
            ],
            "import_time": "2026-08-04T22:30:11.91798017Z"
        }
    ]
}
References
Credits

Affected packages

npm / twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer

Package

Name
twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer
View open source insights on deps.dev
Purl
pkg:npm/twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer

Affected ranges

Affected versions

20.*
20.5.3

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-iO4/yKlBEO8QEb3YIHe5dBOYPKkuDuGzPVoXHX/daLqpRwejpqZckz5+sPPqKiN7reB0WX0PR2PDEfk3DPnZtg==",
                "sha1": "39340c8824b553a9561ae6edf3c2c1c97082cb4c"
            },
            "filename": "twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer-20.5.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "sha256": "025433674448d6709785d2894a1a5e58281b00599cd5f718a923d54578d6eca7",
            "tlsh": "a8a1a69a167a70098bf0dbe4cb1b5805f65ae26337808194f79c65885f7206483b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer/MAL-2026-11550.json"