OpenSSF/OSV advisory MAL-2026-12413 confirms this npm version as malicious. On require(), _polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several *.workers.dev hosts whose names are assembled at runtime by joining split string fragments, writes it to /tmp or %TEMP% under a decoy name such as dotnet_diag_<rand>.exe or.cache_<rand>, sets mode 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in pfp-forms-mobile-sme-group-tiles (npm)
Details
On require(), _polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several *.workers.dev hosts whose names are assembled at runtime by joining split string fragments, writes it to /tmp or %TEMP% under a decoy name such as dotnet_diag_<rand>.exe or.cache_<rand>, sets mode 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-over-TXT fallback channel reassembles a base64 payload from numbered TXT records under *.dl.well1.site. Hostnames are constructed from arrays of fragments to evade string search, and a cooldown state file gates re-execution. The package advertises a 'merchant service layer' role and ships no legitimate need for a hidden native payload dropper.
Decision reason
OpenSSF Malicious Packages via OSV confirms pfp-forms-mobile-sme-group-tiles@20.3.6 as malicious (MAL-2026-12413): Malicious code in pfp-forms-mobile-sme-group-tiles (npm)