accounts-offers

{"modified":"2026-08-05T09:08:36Z","published":"2026-08-05T09:08:36Z","schema_version":"1.7.4","id":"MAL-2026-12135","summary":"Malicious code in accounts-offers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7)\nThe package advertises itself as an 'Accounts offers library' but on require() index.js silently loads setup.js, which via process.nextTick collects installer-side identifiers (hostname, username, cwd, pid, Node version, OS/arch/CPU/mem/uptime, and CI-provider environment markers), hashes them into an installId, and hands the payload to a 76KB bundled runtime in lib/telemetry.js. Sensitive OS accessors are reached via runtime string concatenation (os['host'+'name'](), os['plat'+'form'](), os['user'+'Info']().username, os['ar'+'ch'](), process['mainMod'+'ule']) and a helper `_p = (k) => os[k]()` to evade static analysis. lib/telemetry.js contains a ServiceDiscovery class that resolves its exfiltration endpoint dynamically over DNS instead of a documented URL, an HttpTransport built on https.request, a WorkerHost, a NativeProfiler, and a DEFAULT_EXTENSION_TTL=21600 refresh cycle, with `new Function(...)` and Buffer.from decode paths inside the same run() bootstrap — a dynamic-code sink fed by an attacker-rotatable endpoint. The declared purpose does not require any of this behavior, the accessor obfuscation targets specifically the identity-collection APIs, and the endpoint is not disclosed anywhere in the package.\n","affected":[{"package":{"ecosystem":"npm","name":"accounts-offers"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6","tlsh":"1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f"},{"path":"lib/telemetry.js","sha256":"eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553","tlsh":"6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd"}],"package_integrity":[{"filename":"accounts-offers-0.0.1.tgz","hashes":{"sha1":"500ad742c00fd6b78e607cf4932d8f6aa5b0bcf2","sha512_sri":"sha512-0OoP/+vNN/q2RdBJUIIACzbqMBvW2MDAEy59BfEBFs4jaoceOwAgIn5fSX6fwO77AUYPJ5wIlr+hXgflEOHvAQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-offers/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014563","import_time":"2026-08-05T09:28:25.916209185Z","modified_time":"2026-08-05T09:08:36Z","sha256":"2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7","source":"amazon-inspector","versions":["0.0.1"]}]}}