MAL-2026-12294

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config/MAL-2026-12294.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12294
Published
2026-08-05T09:14:33Z
Modified
2026-08-05T10:07:04.780694316Z
Summary
Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f)

On require(), index.js loads adapter.js, which downloads a platform-specific binary from Cloudflare Workers hosts under oob-worker.cf10x-*.workers.dev assembled by array-join string concatenation, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS retrieval fails, adapter.js falls back to a DNS TXT covert channel resolving c.<domain> and N.<domain> under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, reconstructing a base64-encoded payload from the TXT records and executing it via the same write-and-spawn path. Endpoint hosts and DNS domains are built via array.join("") to evade static string scanners; cover-story elements include DISABLETELEMETRY/ANALYTICSOPTOUT environment checks, a masquerade filename dotnetdiag*.exe, and a.analytics_state marker file gating repeat runs. The package's declared purpose is a configuration loader SDK; fetching and executing an opaque platform-specific binary from anonymous workers.dev hosts on import does not correspond to any documented functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:14:33Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014604",
            "import_time": "2026-08-05T09:28:29.603875547Z",
            "sha256": "1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f",
            "versions": [
                "20.6.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config

Package

Name
twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config
View open source insights on deps.dev
Purl
pkg:npm/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config

Affected ranges

Affected versions

20.*
20.6.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config-20.6.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-DNYpTaa2jhN68p6XP2aiTrSd1iz4bpiUOTEtAxM7j3JkvZqd5BHwwOmY6l7KYBa+ObFykJNTTmiPvhUHFTDAKQ==",
                "sha1": "53f7bee6b701fe6dea7e00b94db8c7a82a54d017"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "3ab1b96a126630184bb0d7e4c71b5816f55af66373908284fb9ca5d85ff312482b2ffc",
            "sha256": "04063b3e80b16f581ed9368b1beea7757e6e40a5309627e806913643625fbc44",
            "path": "_adapter.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config/MAL-2026-12294.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]