MAL-2026-12131

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-constants/MAL-2026-12131.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12131
Published
2026-08-05T09:06:50Z
Modified
2026-08-05T10:05:43.710221697Z
Summary
Malicious code in accounts-constants (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7)

On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf10-3-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked-base64 fallback under *.dl.well1.site whose domain labels are also reconstructed from split arrays. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmod 0o755'd, and spawned detached via spawn("/bin/sh", ["-c", <path>+" &"], {detached:true}).unref() or the cmd equivalent. There is no hash or signature verification of the downloaded bytes, the endpoints are attacker-controlled Cloudflare Workers hosts unrelated to any declared publisher, and the package's stated purpose ("accounts constants wrapper") does not involve any native binary. Additional anti-analysis behavior includes a fake env-var opt-out (DISABLETELEMETRY / ANALYTICSOPTOUT / DONOT_TRACK), an mtime staleness marker gating re-execution, and stderr silencing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "4f43fcf66944e40e1f9523d2462f76bb9eb107b7100747d90d26a8081945c21c",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014555",
            "modified_time": "2026-08-05T09:07:33Z",
            "import_time": "2026-08-05T09:28:25.09593708Z",
            "versions": [
                "0.0.2"
            ]
        },
        {
            "sha256": "b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014550",
            "modified_time": "2026-08-05T09:06:50Z",
            "import_time": "2026-08-05T09:28:24.604564156Z",
            "versions": [
                "33.1.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / accounts-constants

Package

Name
accounts-constants
View open source insights on deps.dev
Purl
pkg:npm/accounts-constants

Affected ranges

Affected versions

0.*
0.0.2
33.*
33.1.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "46daa08fde1ba4ed1a8ec3cb3e256ce82c80d956a706cff8ef9b1313f03608db",
            "path": "_helpers.js",
            "tlsh": "4ca185a602a670194bb0e7e4db1b8815fa5bf663778082c4fb5c65945f7312483b2efc"
        },
        {
            "sha256": "9dae3d0bde4921e3e0f765a99eced7b4046daa7f7af6e765508eb804f821c5f9",
            "path": "lib/telemetry.js",
            "tlsh": "38835055566a202186b2b368df234007ff3685272643429dbafc82dc1fbd72092a5ffd"
        }
    ],
    "package_integrity": [
        {
            "filename": "accounts-constants-0.0.2.tgz",
            "hashes": {
                "sha1": "53429eae1b4fac52e37ca7e96980ed8441c13a80",
                "sha512_sri": "sha512-hQxNDI/nq2HI1d6ugRGs2Q/X0l+kft6YKoiOfEZYtYkrm2Tzy47FL+8kxfjUXQyf7wt/j24PGHGykSSF8k9ZBA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-constants/MAL-2026-12131.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]