MAL-2026-12129

    Dashboard / Malicious Package / MAL-2026-12129

    MAL-2026-12129

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in accounts-appointment (npm)

    Details: Source: amazon-inspector (b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a) index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.dev subdomains (oob-worker.cf99-9b3.workers.dev and siblings cf100-416/cf101-adf/cf103-070.workers.dev) with a DNS TXT-record fallback channel under *.dl.well1.site, writes the payload to /var/tmp or %TEMP% under decoy names resembling.NET diagnostic files (.cache_<hex> / dotnet_diag_<hex>.exe), chmods 0755 on unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Endpoint hostnames are assembled via array-join string concatenation to evade static string search, and a secondary DNS TXT loader queries c.<domain> for a chunk count and reassembles base64 chunks from N.<domain> TXT records. The dropper fires on any require/import of the package and executes attacker-controlled code on the installer's host.

    References: https://www.npmjs.com/package/accounts-appointment/v/33.2.6, https://www.npmjs.com/package/accounts-appointment/v/0.0.2

    Affected packages

    Package

    Name: accounts-appointment

    Purl: pkg:npm/accounts-appointment

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    33.2.6
    MAL-2026-12129 | CVE-DB