MAL-2026-12420
Dashboard / Malicious Package / MAL-2026-12420
MAL-2026-12420
Summary: Malicious code in prokit-core (npm)
Details: Source: amazon-inspector (8d1f094f3b3aea4e6c087847823efe5c1f1a930ac746aa2696259951e6332f92) On require of the package, index.js unconditionally loads _helpers.js, which selects a platform-specific target, downloads an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled at runtime by joining split string fragments (e.g. oob-worker.cf101-adf.workers.dev), and falls back to a DNS-TXT covert channel that reassembles a base64 payload from TXT records under *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site, tina.dl.well1.site). The retrieved bytes are written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A /tmp/.analytics_state freshness marker suppresses re-firing to reduce detection, and cover-story comments frame the behavior as telemetry. Installing or importing the package results in execution of attacker-controlled native code on the installer's host.
Affected packages
Package
Name: prokit-core
Purl: pkg:npm/prokit-core
Affected ranges
Type: N/A
Events:
