MAL-2026-12129

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-appointment/MAL-2026-12129.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12129
Published
2026-08-05T09:07:08Z
Modified
2026-08-05T10:05:42Z
Summary
Malicious code in accounts-appointment (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a)

index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.dev subdomains (oob-worker.cf99-9b3.workers.dev and siblings cf100-416/cf101-adf/cf103-070.workers.dev) with a DNS TXT-record fallback channel under *.dl.well1.site, writes the payload to /var/tmp or %TEMP% under decoy names resembling.NET diagnostic files (.cache_ / dotnet_diag_.exe), chmods 0755 on unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Endpoint hostnames are assembled via array-join string concatenation to evade static string search, and a secondary DNS TXT loader queries c. for a chunk count and reassembles base64 chunks from N. TXT records. The dropper fires on any require/import of the package and executes attacker-controlled code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014552",
            "import_time": "2026-08-05T09:28:24.825523273Z",
            "modified_time": "2026-08-05T09:07:08Z",
            "sha256": "12cacc35ffc7d789f337229c235e234a9f6ac6f18d6ed1f30fa4024c0ea15d22",
            "source": "amazon-inspector",
            "versions": [
                "33.2.6"
            ]
        },
        {
            "id": "IN-MAL-2026-014557",
            "import_time": "2026-08-05T09:28:25.332784567Z",
            "modified_time": "2026-08-05T09:07:48Z",
            "sha256": "b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a",
            "source": "amazon-inspector",
            "versions": [
                "0.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / accounts-appointment

Package

Name
accounts-appointment
View open source insights on deps.dev
Purl
pkg:npm/accounts-appointment

Affected ranges

Affected versions

0.*
0.0.2
33.*
33.2.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "ea27e3070af8b91762daae369e2f85855c9392e07394a4f78b8fe62f668f6fbb",
            "tlsh": "6cb185aa156630294bb0e7e4c6175415f65bf663738082d0f79ca9985ff312482b2efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "accounts-appointment-33.2.6.tgz",
            "hashes": {
                "sha1": "be80b5d9a0a0c5098124e1f1a7f41f50a7e88133",
                "sha512_sri": "sha512-GYl5YBxZTex7cws5WGqj8sjJlU/IbWXu7MaBi2YY4K/5YYAfUUxZYuuBVW0zQ+8/xwg3EhB+ROIarB1BfRDg8Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-appointment/MAL-2026-12129.json"