MAL-2026-12132

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-ddos-shield/MAL-2026-12132.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12132
Published
2026-08-05T09:06:43Z
Modified
2026-08-05T10:05:44.108096103Z
Summary
Malicious code in accounts-ddos-shield (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (343cd6e6bdb885bf8fe4d59b376a32c5ab57f309707c4253b2bf7307d631be79)

On require of the package, helpers.js selects a platform-specific payload path and downloads an opaque binary from one of several Cloudflare Workers hosts whose names are assembled from split string fragments via Array.join to hide the destinations from static inspection (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT reassembly fallback under tin/tina/ldr/win.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under decoy names impersonating Microsoft diagnostics (dotnetdiag<hex>.exe,.cache<hex>,.analytics_state), chmod 0755 on POSIX, and spawned detached via /bin/sh or cmd.exe start. The module is labeled _helpers.js with telemetry-framing comments while it stages and executes a remote binary. The package name presents as a DDoS-protection utility, but no such functionality is delivered — the sole effect of loading the module is to run attacker-controlled code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "343cd6e6bdb885bf8fe4d59b376a32c5ab57f309707c4253b2bf7307d631be79",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:24.513982732Z",
            "modified_time": "2026-08-05T09:06:43Z",
            "versions": [
                "33.3.8"
            ],
            "id": "IN-MAL-2026-014549"
        },
        {
            "sha256": "3bd79f6fb6188c1b18eb067e515747ea24c328e491275e52c83910da1e44d71b",
            "source": "amazon-inspector",
            "versions": [
                "0.0.2"
            ],
            "import_time": "2026-08-05T09:28:25.470397767Z",
            "modified_time": "2026-08-05T09:07:55Z",
            "id": "IN-MAL-2026-014558"
        }
    ]
}
References
Credits

Affected packages

npm / accounts-ddos-shield

Package

Name
accounts-ddos-shield
View open source insights on deps.dev
Purl
pkg:npm/accounts-ddos-shield

Affected ranges

Affected versions

0.*
0.0.2
33.*
33.3.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "a5890df7c80b012c10e3cfd5306271a8e5e7b143",
                "sha512_sri": "sha512-JiaVi1cnsNcw17O/5A8xLQzt7Pq5dW5PuXMrc4bWF5CP8am3q36sYIARNirQ5NhHl78GSB8E9HkiaaJUPb1LUw=="
            },
            "filename": "accounts-ddos-shield-33.3.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "sha256": "5ca6283290df600366d040c53c83f14f527916ff604d13424bd7b6d34ef6f6c4",
            "tlsh": "48b1836a056a60184bb0dbe0c7175416f567f26377809290f79ca9885ff2224c3b2efc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-ddos-shield/MAL-2026-12132.json"