registry / Remote code execution / twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config
twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config
service client SDK
This report shows the evidence for twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config@20.6.1, the only known version.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time remote-code-execution chain unrelated to the declared config SDK functionality. The lack of npm lifecycle hooks does not mitigate runtime import execution.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Any runtime require/import of the package entrypoint.
Impact
Arbitrary remote code executes with the importing process's permissions.
Mechanism
import-time remote binary download, drop, chmod, and detached execution
Attack narrative
The package entrypoint silently requires _adapter.js. On import, that module contacts rotated workers.dev hosts or reconstructs a binary from DNS TXT records, writes it into a temp directory, makes it executable on Unix, and starts it detached via a shell or cmd.exe. A short-lived marker suppresses repeat runs.
AI rationale
This is a concrete import-time remote-code-execution chain unrelated to the declared config SDK functionality. The lack of npm lifecycle hooks does not mitigate runtime import execution.
Evidence
package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf103-070.workers.dev/pkg/package