a.poltoradnev-package-b

{"modified":"2026-08-05T09:30:28Z","published":"2026-08-05T09:11:13Z","schema_version":"1.7.4","id":"MAL-2026-12126","summary":"Malicious code in a.poltoradnev-package-b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ebe5bbc564bb1c441ce12acaf4d177fabcd3fe5963f3c870119ee1519abab675)\nOn require() of the package, index.js loads _bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-4.16.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT fallback channel reconstructs a base64 payload from numbered subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site when the HTTPS fetch fails. Destination hostnames are constructed at runtime via Array.join on split fragments to evade static analysis. The written binary is unpinned, unsigned, and unverified, and the code path fires as an import-time side effect rather than through any explicit user action; cover-story identifiers (analytics_state, dotnet_diag_, a DISABLE_TELEMETRY gate) do not correspond to installer-configured behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"a.poltoradnev-package-b"},"versions":["0.0.2","33.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"ab861f85b12bac35fed50e84fa64e1ce982f38ef28ee987ac34a0b97744564c6","tlsh":"feb186aa15a9701947b0ebe4c6175419f65af66373808194f79ca9881ff2124c2f2efc"}],"package_integrity":[{"filename":"a.poltoradnev-package-b-0.0.2.tgz","hashes":{"sha1":"dc13b1d44a7d79e7558208f3b4a7cb9761821751","sha512_sri":"sha512-1QYGxs4JCsy8NwHuOQpUJoaz+/anlrCL4L3f+ETXReEugPIwv9vRW2p6/8/0Cj8gBpd6NMkkIvx8C7KdrXNRDg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/a.poltoradnev-package-b/v/0.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/a.poltoradnev-package-b/v/33.9.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014583","import_time":"2026-08-05T09:28:27.79934991Z","modified_time":"2026-08-05T09:11:32Z","sha256":"8a49533ddaeb856979ea3ed058fcb5955d6b20c2e5711401b597c2369e544d40","source":"amazon-inspector","versions":["0.0.2"]},{"id":"IN-MAL-2026-014581","import_time":"2026-08-05T09:28:27.610756359Z","modified_time":"2026-08-05T09:11:13Z","sha256":"ebe5bbc564bb1c441ce12acaf4d177fabcd3fe5963f3c870119ee1519abab675","source":"amazon-inspector","versions":["33.9.1"]}]}}