MAL-2026-12137

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-timeline/MAL-2026-12137.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12137
Published
2026-08-05T08:50:09Z
Modified
2026-08-05T10:05:46.409810944Z
Summary
Malicious code in accounts-timeline (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df)

On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on OS/arch, setup.js selects one of /pkg/package, /pkg/package.exe, /pkg/loadermac, or /pkg/package-arm64 and invokes lib/telemetry.js runtime.run(), which fetches bytes from hardcoded remote endpoints, base64-decodes them, writes them to /var/tmp (or %TEMP% on Windows), chmods 0755, and executes the resulting binary. The destination hostnames (package-proxy.cf5oob.workers.dev, package-proxy.cf8oob.workers.dev, package-proxy.cf12oob.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev, and tin/tina/ldr/win subdomains of dl.well1.site) are assembled at runtime from split-string arrays via.join(""), and sensitive API names (childprocess, fs.chmodSync, os.hostname, os.platform) are reassembled from property-name concatenation to evade static analysis. setup.js additionally computes an installFingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid, sha256-hashes it, and passes it as installId in the fetch request, causing installer host identifiers to be transmitted to the same attacker-controlled endpoints. The package presents itself as an accounts SDK and has no legitimate need for a platform-branched binary fetch-decode-chmod-exec pipeline pointed at anonymous Cloudflare Workers subdomains.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T09:08:28Z",
            "id": "IN-MAL-2026-014562",
            "import_time": "2026-08-05T09:28:25.827562208Z",
            "sha256": "06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df",
            "versions": [
                "9.6.9"
            ]
        },
        {
            "modified_time": "2026-08-05T09:08:21Z",
            "source": "amazon-inspector",
            "sha256": "974138e46cacbcbfb8e2c741afdd2e447d60ec327bfb290c19ede3717f857e8a",
            "import_time": "2026-08-05T09:28:25.73875336Z",
            "id": "IN-MAL-2026-014561",
            "versions": [
                "9.6.10"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T09:08:12Z",
            "sha256": "0db1a3a62db9be6db76099dec022af0991f32c738f46ad8b47c4e09fcf4f2bfb",
            "import_time": "2026-08-05T09:28:25.654211016Z",
            "id": "IN-MAL-2026-014560",
            "versions": [
                "9.6.11"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:50:09Z",
            "sha256": "0e3a0b0d3a2f92d7c7085811561a7a87ecd3dca2779934f7c6f0672c88d3f3c1",
            "import_time": "2026-08-05T09:28:10.82348051Z",
            "id": "IN-MAL-2026-014436",
            "versions": [
                "9.6.12"
            ]
        },
        {
            "modified_time": "2026-08-05T09:08:04Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014559",
            "import_time": "2026-08-05T09:28:25.560311029Z",
            "sha256": "2e6985bcd929a499e10c5ea64ba66c7b67eef3a7d6c7e5a3409818e53b996927",
            "versions": [
                "12.3.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / accounts-timeline

Package

Name
accounts-timeline
View open source insights on deps.dev
Purl
pkg:npm/accounts-timeline

Affected ranges

Affected versions

9.*
9.6.9
9.6.10
9.6.11
9.6.12
12.*
12.3.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "accounts-timeline-9.6.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-uxvaNT6sQYCNEMgxh0i4A1JBeJfPZTM7tcomSFgIUEdpMw2Loer9Ff71+7SlETK1WDccE94hECPZSD/H5UUN3Q==",
                "sha1": "dddabb2a00c76c6a9bac4e751964f6fe4db515a1"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "519164084ed525250298e3f9296a4447e89614537ac8f248ba4ff2589f98138877ffbe",
            "sha256": "44d13ca192133d1e1bb3c0dad1695c5167c4284e9789163c5347c821f267653e",
            "path": "setup.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-timeline/MAL-2026-12137.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]