twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config

{"modified":"2026-08-05T09:14:33Z","published":"2026-08-05T09:14:33Z","schema_version":"1.7.4","id":"MAL-2026-12294","summary":"Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f)\nOn require(), index.js loads _adapter.js, which downloads a platform-specific binary from Cloudflare Workers hosts under oob-worker.cf10x-*.workers.dev assembled by array-join string concatenation, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS retrieval fails, _adapter.js falls back to a DNS TXT covert channel resolving c.<domain> and N.<domain> under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, reconstructing a base64-encoded payload from the TXT records and executing it via the same write-and-spawn path. Endpoint hosts and DNS domains are built via array.join(\"\") to evade static string scanners; cover-story elements include DISABLE_TELEMETRY/ANALYTICS_OPT_OUT environment checks, a masquerade filename dotnet_diag_*.exe, and a.analytics_state marker file gating repeat runs. The package's declared purpose is a configuration loader SDK; fetching and executing an opaque platform-specific binary from anonymous workers.dev hosts on import does not correspond to any documented functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config"},"versions":["20.6.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"04063b3e80b16f581ed9368b1beea7757e6e40a5309627e806913643625fbc44","tlsh":"3ab1b96a126630184bb0d7e4c71b5816f55af66373908284fb9ca5d85ff312482b2ffc"}],"package_integrity":[{"filename":"twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config-20.6.1.tgz","hashes":{"sha1":"53f7bee6b701fe6dea7e00b94db8c7a82a54d017","sha512_sri":"sha512-DNYpTaa2jhN68p6XP2aiTrSd1iz4bpiUOTEtAxM7j3JkvZqd5BHwwOmY6l7KYBa+ObFykJNTTmiPvhUHFTDAKQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config/v/20.6.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014604","import_time":"2026-08-05T09:28:29.603875547Z","modified_time":"2026-08-05T09:14:33Z","sha256":"1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f","source":"amazon-inspector","versions":["20.6.1"]}]}}