MAL-2026-12186

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pfp-forms-insurance-health/MAL-2026-12186.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12186
Published
2026-08-05T08:56:34Z
Modified
2026-08-05T10:06:12.377668442Z
Summary
Malicious code in pfp-forms-insurance-health (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96)

On require('pfp-forms-insurance-health'), index.js loads compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloads an opaque native binary from one of four Cloudflare Workers subdomains under oob-worker.cf10{0,1,2,3}-*.workers.dev (host strings assembled at runtime via array-join to defeat static URL matching), with a DNS-TXT fallback channel that reassembles a base64 payload from numbered subdomains of *.dl.well1.site. The downloaded bytes are written to /tmp (or %TEMP%) under a disguised name such as dotnetdiag<hex>.exe or.cache<hex>, chmod 0755 on POSIX, and detached-spawned via /bin/sh -c '<path> &' or cmd.exe /c start. A separate lib/telemetry.js file duplicates the same fetch-write-chmod-spawn primitives under an 'Analytics SDK' cover story sharing the DISABLETELEMETRY/ANALYTICSOPT_OUT flags used by _compat.js. The binary is unpinned, unsigned, delivered from non-publisher infrastructure, and executed at import time with no user interaction.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T09:28:16.929793504Z",
            "modified_time": "2026-08-05T08:56:34Z",
            "versions": [
                "20.2.2"
            ],
            "id": "IN-MAL-2026-014480"
        }
    ]
}
References
Credits

Affected packages

npm / pfp-forms-insurance-health

Package

Name
pfp-forms-insurance-health
View open source insights on deps.dev
Purl
pkg:npm/pfp-forms-insurance-health

Affected ranges

Affected versions

20.*
20.2.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "86b2c4431d7a0f1033d66c9fadbb0bb89ca55c4b",
                "sha512_sri": "sha512-kRU0wjhIpUYQM8c0sjDVnCFU0PWvpZfqltFa/gq554DQAVwdkPswdWmtscrCfJgjBuuD+vlAegwGmVAH4VjryA=="
            },
            "filename": "pfp-forms-insurance-health-20.2.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "sha256": "08d9aeee245d382072d22c151e9eec57fd52c4411885dbd05bd9c696ed2b51b0",
            "tlsh": "82b1c89a126670194fb0dbe0cb1b8825f55bf25337818290f79c69945fb352483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "d4888eee476a08435238e30d0f0e134313d17c702d3e7605ea5f8a162d6aaf5f",
            "tlsh": "52835056566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffd"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pfp-forms-insurance-health/MAL-2026-12186.json"