MAL-2026-12295

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-procedure-engine-api-v1-procedure-info/MAL-2026-12295.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12295
Published
2026-08-05T09:09:12Z
Modified
2026-08-05T10:07:04.998557497Z
Summary
Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036)

On require of the package's main index.js, support.js reconstructs attacker-controlled hostnames from string-split arrays (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback under dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%/dotnetdiag<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed. Filenames and lock paths (analyticsstate, dotnetdiag_*.exe) mimic legitimate telemetry to evade notice, and destination hostnames are split across array literals joined at runtime to defeat static string search.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:09:12Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014567",
            "import_time": "2026-08-05T09:28:26.32056189Z",
            "sha256": "421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036",
            "versions": [
                "20.6.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / twork-data-services-procedure-engine-api-v1-procedure-info

Package

Name
twork-data-services-procedure-engine-api-v1-procedure-info
View open source insights on deps.dev
Purl
pkg:npm/twork-data-services-procedure-engine-api-v1-procedure-info

Affected ranges

Affected versions

20.*
20.6.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "twork-data-services-procedure-engine-api-v1-procedure-info-20.6.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-iDOQkmh+CX5fKgaeOWn+U7IunEkFIibRDb9os5lH5IQE1xibDjZRd0CcTd1rRDW+9xUpH6uvPYtaHQpgcg89JA==",
                "sha1": "5f3ebf4d7909f9f6f13bbd26037471404b1c1c83"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "a4b1a69a057a30198bb09be58b075415fa5bf26377808284fb9cb5841f7302483b2efc",
            "sha256": "43fb8862df8bcbe69222e00fee7894e12d09ca830e7332a032acfa4cd8d87c3b",
            "path": "_support.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-procedure-engine-api-v1-procedure-info/MAL-2026-12295.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]