MAL-2026-12135

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-offers/MAL-2026-12135.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12135
Published
2026-08-05T09:08:36Z
Modified
2026-08-05T10:05:45.475263581Z
Summary
Malicious code in accounts-offers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7)

The package advertises itself as an 'Accounts offers library' but on require() index.js silently loads setup.js, which via process.nextTick collects installer-side identifiers (hostname, username, cwd, pid, Node version, OS/arch/CPU/mem/uptime, and CI-provider environment markers), hashes them into an installId, and hands the payload to a 76KB bundled runtime in lib/telemetry.js. Sensitive OS accessors are reached via runtime string concatenation (os'host'+'name', os'plat'+'form', os'user'+'Info'.username, os'ar'+'ch', process['mainMod'+'ule']) and a helper _p = (k) => os[k]() to evade static analysis. lib/telemetry.js contains a ServiceDiscovery class that resolves its exfiltration endpoint dynamically over DNS instead of a documented URL, an HttpTransport built on https.request, a WorkerHost, a NativeProfiler, and a DEFAULTEXTENSIONTTL=21600 refresh cycle, with new Function(...) and Buffer.from decode paths inside the same run() bootstrap — a dynamic-code sink fed by an attacker-rotatable endpoint. The declared purpose does not require any of this behavior, the accessor obfuscation targets specifically the identity-collection APIs, and the endpoint is not disclosed anywhere in the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014563",
            "import_time": "2026-08-05T09:28:25.916209185Z",
            "sha256": "2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7",
            "modified_time": "2026-08-05T09:08:36Z",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / accounts-offers

Package

Name
accounts-offers
View open source insights on deps.dev
Purl
pkg:npm/accounts-offers

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "tlsh": "1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f",
            "sha256": "56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd",
            "sha256": "eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553"
        }
    ],
    "package_integrity": [
        {
            "filename": "accounts-offers-0.0.1.tgz",
            "hashes": {
                "sha1": "500ad742c00fd6b78e607cf4932d8f6aa5b0bcf2",
                "sha512_sri": "sha512-0OoP/+vNN/q2RdBJUIIACzbqMBvW2MDAEy59BfEBFs4jaoceOwAgIn5fSX6fwO77AUYPJ5wIlr+hXgflEOHvAQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-offers/MAL-2026-12135.json"