MAL-2026-12126

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/a.poltoradnev-package-b/MAL-2026-12126.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12126
Published
2026-08-05T09:11:13Z
Modified
2026-08-05T10:05:41.278917942Z
Summary
Malicious code in a.poltoradnev-package-b (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ebe5bbc564bb1c441ce12acaf4d177fabcd3fe5963f3c870119ee1519abab675)

On require() of the package, index.js loads bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-4.16.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT fallback channel reconstructs a base64 payload from numbered subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site when the HTTPS fetch fails. Destination hostnames are constructed at runtime via Array.join on split fragments to evade static analysis. The written binary is unpinned, unsigned, and unverified, and the code path fires as an import-time side effect rather than through any explicit user action; cover-story identifiers (analyticsstate, dotnetdiag_, a DISABLE_TELEMETRY gate) do not correspond to installer-configured behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014583",
            "import_time": "2026-08-05T09:28:27.79934991Z",
            "sha256": "8a49533ddaeb856979ea3ed058fcb5955d6b20c2e5711401b597c2369e544d40",
            "modified_time": "2026-08-05T09:11:32Z",
            "versions": [
                "0.0.2"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-014581",
            "import_time": "2026-08-05T09:28:27.610756359Z",
            "sha256": "ebe5bbc564bb1c441ce12acaf4d177fabcd3fe5963f3c870119ee1519abab675",
            "modified_time": "2026-08-05T09:11:13Z",
            "versions": [
                "33.9.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / a.poltoradnev-package-b

Package

Name
a.poltoradnev-package-b
View open source insights on deps.dev
Purl
pkg:npm/a.poltoradnev-package-b

Affected ranges

Affected versions

0.*
0.0.2
33.*
33.9.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1QYGxs4JCsy8NwHuOQpUJoaz+/anlrCL4L3f+ETXReEugPIwv9vRW2p6/8/0Cj8gBpd6NMkkIvx8C7KdrXNRDg==",
                "sha1": "dc13b1d44a7d79e7558208f3b4a7cb9761821751"
            },
            "filename": "a.poltoradnev-package-b-0.0.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "ab861f85b12bac35fed50e84fa64e1ce982f38ef28ee987ac34a0b97744564c6",
            "path": "_bridge.js",
            "tlsh": "feb186aa15a9701947b0ebe4c6175419f65af66373808194f79ca9881ff2124c2f2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/a.poltoradnev-package-b/MAL-2026-12126.json"