🛡️ MAL-2026-12073 — sso-tramvai-module-context-auth

Malicious code in sso-tramvai-module-context-auth (npm)

Source: amazon-inspector

The package advertises itself as an auth-token handler but on require() its index.js loads _vendor.js, which reconstructs destination hostnames from array joins (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, and a *.dl.well1.site DNS-TXT fallback channel) to evade static string matching, downloads a platform-specific binary, writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows with cover-story filenames, chmods 0755, and spawns it detached with stdio ignored via /bin/sh -c '<path> &' or cmd.exe /c start /b, calling unref() to keep it alive after the Node process exits. Execution is gated by opt-out env vars and a TTL state-file cache to reduce re-execution visibility. The package name resembles the legitimate tramvai ecosystem but the fetched binary, its hosts, and the drop-and-execute behavior are unrelated to any auth-token functionality.