MAL-2026-12406

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pfa-errors/MAL-2026-12406.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12406
Published
2026-08-05T12:51:05Z
Modified
2026-08-05T13:35:40.734277168Z
Summary
Malicious code in pfa-errors (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f)

On require('pfa-errors'), index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded Cloudflare workers.dev endpoints (oob-worker.cf100-416.workers.dev and siblings), writes it to a temp path with a decoy name (.cache<hex> or dotnetdiag<hex>.exe), sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe. When HTTPS is unavailable, a DNS-TXT covert channel to *.dl.well1.site reconstructs the binary from base64 chunks. Destination hostnames and sensitive API names such as child_process and chmodSync are fragmented into arrays and reassembled with.join('') at runtime to evade static string search. A second, functionally identical dropper shipped in lib/telemetry.js is not reached from index.js but embeds the same fetch+chmod+spawn primitives.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f",
            "source": "amazon-inspector",
            "versions": [
                "20.4.9"
            ],
            "import_time": "2026-08-05T13:08:46.419501848Z",
            "modified_time": "2026-08-05T12:51:05Z",
            "id": "IN-MAL-2026-014786"
        }
    ]
}
References
Credits

Affected packages

npm / pfa-errors

Package

Name
pfa-errors
View open source insights on deps.dev
Purl
pkg:npm/pfa-errors

Affected ranges

Affected versions

20.*
20.4.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "8e7930b7eb4ed52c4fbf96d14a094ae3122c6ac1",
                "sha512_sri": "sha512-cfQmTIrCrar/Ai9b6yjyxC8Dlz1YqlgjXoUmNV7VpFJhaeMh6wbZsDWkqaSLGzV4uU7y9IXpGG7ms+zHR7LlXg=="
            },
            "filename": "pfa-errors-20.4.9.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "sha256": "9c2c27ec3f51d9fa77c288102b489341c5cb72cc10e48f15981cd2957067351a",
            "tlsh": "92a1865a1269311987b0abe5c717441af65bf2533380c2d8fb6c65945fb613483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "bd1f37fc4e5ec86d724917b1719fb8013eae07dc3ca7afb18d2c22ce7a96422d",
            "tlsh": "50834056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pfa-errors/MAL-2026-12406.json"