MAL-2026-12131

Dashboard / Malicious Package / MAL-2026-12131

MAL-2026-12131

Summary: Malicious code in accounts-constants (npm)

Details: Source: amazon-inspector (b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7) On require of the package, index.js loads _helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf10-3-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked-base64 fallback under *.dl.well1.site whose domain labels are also reconstructed from split arrays. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0o755'd, and spawned detached via spawn("/bin/sh", ["-c", <path>+" &"], {detached:true}).unref() or the cmd equivalent. There is no hash or signature verification of the downloaded bytes, the endpoints are attacker-controlled Cloudflare Workers hosts unrelated to any declared publisher, and the package's stated purpose ("accounts constants wrapper") does not involve any native binary. Additional anti-analysis behavior includes a fake env-var opt-out (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK), an mtime staleness marker gating re-execution, and stderr silencing.

References: https://www.npmjs.com/package/accounts-constants/v/0.0.2, https://www.npmjs.com/package/accounts-constants/v/33.1.7