OpenSSF/OSV advisory MAL-2026-12126 confirms this npm version as malicious. On require() of the package, index.js loads _bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-4.16.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in a.poltoradnev-package-b (npm)
Details
On require() of the package, index.js loads _bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-4.16.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT fallback channel reconstructs a base64 payload from numbered subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site when the HTTPS fetch fails. Destination hostnames are constructed at runtime via Array.join on split fragments to evade static analysis. The written binary is unpinned, unsigned, and unverified, and the code path fires as an import-time side effect rather than through any explicit user action; cover-story identifiers (analytics_state, dotnet_diag_, a DISABLE_TELEMETRY gate) do not correspond to installer-configured behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms a.poltoradnev-package-b@33.9.1 as malicious (MAL-2026-12126): Malicious code in a.poltoradnev-package-b (npm)