🛡️ MAL-2026-12129 — accounts-appointment

Malicious code in accounts-appointment (npm)

Source: amazon-inspector

index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.dev subdomains (oob-worker.cf99-9b3.workers.dev and siblings cf100-416/cf101-adf/cf103-070.workers.dev) with a DNS TXT-record fallback channel under *.dl.well1.site, writes the payload to /var/tmp or %TEMP% under decoy names resembling.NET diagnostic files (.cache_<hex> / dotnet_diag_<hex>.exe), chmods 0755 on unix, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Endpoint hostnames are assembled via array-join string concatenation to evade static string search, and a secondary DNS TXT loader queries c.<domain> for a chunk count and reassembles base64 chunks from N.<domain> TXT records. The dropper fires on any require/import of the package and executes attacker-controlled code on the installer's host.