MAL-2026-12128

Dashboard / Malicious Package / MAL-2026-12128

MAL-2026-12128

Summary: Malicious code in aasp-tent-aasp-tent-core (npm)

Details: Source: amazon-inspector (8f40a1f6a1ee90eed076db7cd24155d8dd0ceb6f3bd3b0698eb9ff0b0543efee) On require of the package, index.js loads _compat.js, which detects the host OS/arch and fetches a per-platform native binary from author-controlled hosts whose names are assembled at runtime via array.join("") to hide them from static scanners: oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS TXT fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site (base64 chunks reassembled from TXT records). The downloaded bytes are written under disguised names into /var/tmp or %TEMP% (e.g., dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755, and detached-spawned via cp.spawn("/bin/sh", ["-c", path+" &"]) or cmd.exe /c start /b, yielding remote code execution on the installer's machine at import time. A second module lib/telemetry.js ships a near-identical dropper primitive (require("child_" + "process"), os["host" + "name"](), fs["chmod" + "Sync"], base64 decode + chmod 755 + spawn /bin/sh) that is not currently referenced by index.js but is staged for activation. The package is advertised as a "platform core" but ships no functionality matching that description; its only import-time effect is the binary drop-and-exec chain.

References: https://www.npmjs.com/package/aasp-tent-aasp-tent-core/v/0.0.2, https://www.npmjs.com/package/aasp-tent-aasp-tent-core/v/33.4.6