MAL-2026-12072

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/specials-obid-webpack/MAL-2026-12072.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12072
Published
2026-08-05T01:43:24Z
Modified
2026-08-05T03:20:54.206468831Z
Summary
Malicious code in specials-obid-webpack (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ef5ac97b682821ce99ff6152a28467cd5ec91903d061ba1fc70ef7a3e6b9be03)

On require of the package, _vendor.js selects a URL path by host platform, downloads a binary over HTTPS from destination hostnames assembled at runtime via array .join("") string-splits (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a disguised temp path (/tmp/.cache_<rnd> on Unix, %TEMP%\dotnet_diag_<rnd>.exe on Windows), fs.chmodSync(savePath, 0o755), and spawns it detached via spawn("/bin/sh",...) or spawn("cmd",...). A DNS-TXT covert-channel fallback reassembles base64 chunks from *.dl.well1.site. A parallel dropper implementation is bundled at lib/telemetry.js using the same DNS-base64 reassembly, cp.spawn("/bin/sh", ["-c", filePath + " &"]), and split identifiers ("child_"+"process", "chmod"+"Sync") under a telemetry cover story. Destination hostnames are non-publisher anonymous Cloudflare Workers hosts, filenames impersonate legitimate diagnostic tooling, and identifiers are split to evade static analysis — installing or requiring the package results in unauthenticated remote code execution on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T01:43:24Z",
            "sha256": "ef5ac97b682821ce99ff6152a28467cd5ec91903d061ba1fc70ef7a3e6b9be03",
            "id": "IN-MAL-2026-011517",
            "versions": [
                "20.5.4"
            ],
            "import_time": "2026-08-05T03:11:16.671859943Z"
        }
    ]
}
References
Credits

Affected packages

npm / specials-obid-webpack

Package

Name
specials-obid-webpack
View open source insights on deps.dev
Purl
pkg:npm/specials-obid-webpack

Affected ranges

Affected versions

20.*
20.5.4

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1XLyBvPR6KtJxNA+qL5Jd6Y9QJin3++YwagyAq2MSjWArmv1WnEIcXaBo0TMY3ZuH5RndvnCPGP5kXWK5CjCDw==",
                "sha1": "5760e282a8e8e1bdde58a67916f40127ba296ece"
            },
            "filename": "specials-obid-webpack-20.5.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "1d1d25337478cc60f2693ab18bfda4a2009a79ae57b8e8853a9e9c2e63780871",
            "tlsh": "f7b1c99602a671188bb09bf4cb175415f56bf26333808694fb6ca5d85f7613883b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "a617100f09cd5791d0b17bdb89f61eca20b266d97ec7972d43867d0c2d8a51ae",
            "tlsh": "13835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/specials-obid-webpack/MAL-2026-12072.json"