OpenSSF/OSV advisory MAL-2026-12303 confirms this npm version as malicious. On require of the package, index.js loads _compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback under *.dl.well1.site, downloads a platform-specific binary via https.get, writes it to /var/tmp or the Windows temp directory under a masquerading...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in twork-mf-e2e-nitro (npm)
Details
On require of the package, index.js loads _compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback under *.dl.well1.site, downloads a platform-specific binary via https.get, writes it to /var/tmp or the Windows temp directory under a masquerading name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Misleading comments referencing an 'Analytics SDK', a 'DISABLE_TELEMETRY opt-out', and a 'SHA-256 integrity check' are present in the source; no such integrity check is implemented. A second copy of the same write-chmod-spawn dropper is staged in lib/telemetry.js (81 KB), reachable via dynamic loading. The require("child_"+"process") and fs["chmod"+"Sync"] patterns further evidence deliberate string-level evasion.
Decision reason
OpenSSF Malicious Packages via OSV confirms twork-mf-e2e-nitro@20.8.5 as malicious (MAL-2026-12303): Malicious code in twork-mf-e2e-nitro (npm)