MAL-2026-12668
Dashboard / Malicious Package / MAL-2026-12668
MAL-2026-12668
Summary: Malicious code in custom-plugins-request-factory (npm)
Details: Source: amazon-inspector (c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52) The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers endpoints (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe. If HTTPS delivery fails, setup.js reassembles a base64-encoded payload from DNS TXT records under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) as a covert-channel fallback, decodes it, writes it to disk, and executes it. Network destinations and the child_process require are assembled at runtime from split string fragments, and the package is framed as an analytics/telemetry SDK. lib/telemetry.js ships a parallel write-chmod-spawn dropper with the same obfuscation pattern. Requiring or installing the package results in execution of an opaque attacker-controlled binary on the host.
Affected packages
Package
Name: custom-plugins-request-factory
Purl: pkg:npm/custom-plugins-request-factory
Affected ranges
Type: N/A
Events:
