MAL-2026-12475

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tcb-web-copy-to-clipboard/MAL-2026-12475.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12475
Published
2026-08-05T12:29:35Z
Modified
2026-08-05T13:36:15.788459712Z
Summary
Malicious code in tcb-web-copy-to-clipboard (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb)

The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes over HTTPS from one of four runtime-assembled Cloudflare Workers hosts (with a TXT-record DNS fallback under dl.well1.site), writes the response to /var/tmp or %TEMP% under a disguised name (Unix:.cache<hex>; Windows: dotnetdiag<hex>.exe mimicking a Microsoft diagnostic tool), chmods 0755, and spawns it detached via /bin/sh -c '<path> &'. Both the HTTPS hostnames and DNS domains are assembled by joining split string fragments (e.g. ['oob-worker.','cf101-','adf.workers.de','v'].join('')) to evade static string matching. A cover-story branch checks DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK and writes a.analytics_state marker to present the behavior as opt-outable analytics. A companion lib/telemetry.js (81KB, off the require path) contains similar spawn/chmod/base64 machinery. The fetched executable is unrelated to any clipboard functionality, is unpinned, has no integrity check, and comes from attacker-controlled infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T12:29:35Z",
            "id": "IN-MAL-2026-014677",
            "import_time": "2026-08-05T13:08:36.314480323Z",
            "sha256": "e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb",
            "versions": [
                "20.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tcb-web-copy-to-clipboard

Package

Name
tcb-web-copy-to-clipboard
View open source insights on deps.dev
Purl
pkg:npm/tcb-web-copy-to-clipboard

Affected ranges

Affected versions

20.*
20.1.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tcb-web-copy-to-clipboard-20.1.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-gRW++1EuH9mD394XXd1lcM+YLRSVmnlk//8xWs+Q5XgDsvxiB5sB6W3OKrUUT+cTwrAuGzVaHMWdu3Pzqx/c/w==",
                "sha1": "5727f76ee018b5ddd3228c326f9a537595db4add"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d9a1b66a0665301887b0dbe4c7179415f65af65373808294fb9c65d85fb221883b2efc",
            "sha256": "7bd4b0ef1b99c97291a9ebe4b499b6139debced3c189b0f31d90eac943f8e456",
            "path": "setup.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tcb-web-copy-to-clipboard/MAL-2026-12475.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]