MAL-2026-12073

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sso-tramvai-module-context-auth/MAL-2026-12073.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12073
Published
2026-08-05T01:47:14Z
Modified
2026-08-05T03:20:54.612487899Z
Summary
Malicious code in sso-tramvai-module-context-auth (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22)

The package advertises itself as an auth-token handler but on require() its index.js loads vendor.js, which reconstructs destination hostnames from array joins (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and a *.dl.well1.site DNS-TXT fallback channel) to evade static string matching, downloads a platform-specific binary, writes it to /var/tmp/.cache<rand> on Unix or %TEMP%/dotnetdiag<rand>.exe on Windows with cover-story filenames, chmods 0755, and spawns it detached with stdio ignored via /bin/sh -c '<path> &' or cmd.exe /c start /b, calling unref() to keep it alive after the Node process exits. Execution is gated by opt-out env vars and a TTL state-file cache to reduce re-execution visibility. The package name resembles the legitimate tramvai ecosystem but the fetched binary, its hosts, and the drop-and-execute behavior are unrelated to any auth-token functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "20.4.5"
            ],
            "import_time": "2026-08-05T03:11:17.682177101Z",
            "sha256": "c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22",
            "id": "IN-MAL-2026-011527",
            "modified_time": "2026-08-05T01:47:14Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / sso-tramvai-module-context-auth

Package

Name
sso-tramvai-module-context-auth
View open source insights on deps.dev
Purl
pkg:npm/sso-tramvai-module-context-auth

Affected ranges

Affected versions

20.*
20.4.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "sso-tramvai-module-context-auth-20.4.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-ofP4vkeD+FPEsE0K1Xbye315T0y7bNqvuWj4w5AGhCM07pE+x0yQdYRj3ndCmpEBCrIaXJ1LMuSw6GlqQkR0zw==",
                "sha1": "2859559806144aac877b969bc6abf8a0a83dbf4d"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "d0a3822e0475627abe6aabdcaf12d2f2f249303cbce467edac5749f1e5d2205e",
            "tlsh": "fea1a69a16a6301d8bb0abf5c7174816f65be6633740c194fb5ca9845fb312483b2efc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sso-tramvai-module-context-auth/MAL-2026-12073.json"