OpenSSF/OSV advisory MAL-2026-12129 confirms this npm version as malicious. index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.dev subdomains (oob-worker.cf99-9b3.workers.dev and siblings cf100-416/cf101-adf/cf103-070.workers.dev) with a DNS TXT-record fallback channel under *.dl.well1.site, writes the payload to /var/tmp or %TEMP% under decoy names resembling.NET diagnostic files (.cache_<hex> /...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in accounts-appointment (npm)
Details
index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.dev subdomains (oob-worker.cf99-9b3.workers.dev and siblings cf100-416/cf101-adf/cf103-070.workers.dev) with a DNS TXT-record fallback channel under *.dl.well1.site, writes the payload to /var/tmp or %TEMP% under decoy names resembling.NET diagnostic files (.cache_<hex> / dotnet_diag_<hex>.exe), chmods 0755 on unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Endpoint hostnames are assembled via array-join string concatenation to evade static string search, and a secondary DNS TXT loader queries c.<domain> for a chunk count and reassembles base64 chunks from N.<domain> TXT records. The dropper fires on any require/import of the package and executes attacker-controlled code on the installer's host.
Decision reason
OpenSSF Malicious Packages via OSV confirms accounts-appointment@0.0.2 as malicious (MAL-2026-12129): Malicious code in accounts-appointment (npm)