accounts-forms

{"modified":"2026-08-05T09:30:28Z","published":"2026-08-05T09:06:16Z","schema_version":"1.7.4","id":"MAL-2026-12133","summary":"Malicious code in accounts-forms (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f17174f805fda0f57e8b471b2a788e92836a2c20d5da22e818ed43218503b0ed)\nOn require() of accounts-forms, index.js loads _polyfill.js which selects a platform-specific URL and downloads an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback under *.dl.well1.site. The downloaded bytes are written to a hidden path in /tmp (as.cache_<hex>) or %TEMP% (as dotnet_diag_<hex>.exe or analytics_state), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Destination hostnames are split across array-joined string fragments to evade static analysis, and the dropped binary uses cover-story filenames mimicking diagnostics/analytics artifacts. An opt-out gate keyed on generic telemetry environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) further disguises the fetch-and-execute chain as telemetry. The fetched executable is unsigned, unversioned, unrelated to any documented package purpose, and delivers attacker-controlled code to the installer's host on load.\n","affected":[{"package":{"ecosystem":"npm","name":"accounts-forms"},"versions":["0.0.2","33.2.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"e0507454d65e6e1b2c7ba6664667948c3f28bd163f42421e73fa5b53fe3efe85","tlsh":"67b1a59a01b670198bb0e7e4cb179815f55bf25337818294f7aca9885f7712483b2efc"},{"path":"lib/telemetry.js","sha256":"b4a215b693335019848967e1bb154c7abca9b013a9b1b23e6a296d2c9f120f9e","tlsh":"d8835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"accounts-forms-0.0.2.tgz","hashes":{"sha1":"f006b5b8446ad77e707e91a90d4035772fd690a8","sha512_sri":"sha512-k1pRxzXpK2TFAKM4KBZhN/AHxuP49+MKp1l4DYTulrmbajWyZntem/EgMD8FbqlLbc51vKgsKUZe3FFLmsuy6A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-forms/v/0.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-forms/v/33.2.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014556","import_time":"2026-08-05T09:28:25.219363047Z","modified_time":"2026-08-05T09:07:41Z","sha256":"bc4d8be7b3e360413a04c895b17353dc61276c737614c629341c547f5b3c7bd9","source":"amazon-inspector","versions":["0.0.2"]},{"id":"IN-MAL-2026-014546","import_time":"2026-08-05T09:28:24.22045899Z","modified_time":"2026-08-05T09:06:16Z","sha256":"f17174f805fda0f57e8b471b2a788e92836a2c20d5da22e818ed43218503b0ed","source":"amazon-inspector","versions":["33.2.6"]}]}}