🛡️ MAL-2026-12135 — accounts-offers

Malicious code in accounts-offers (npm)

Source: amazon-inspector

The package advertises itself as an 'Accounts offers library' but on require() index.js silently loads setup.js, which via process.nextTick collects installer-side identifiers (hostname, username, cwd, pid, Node version, OS/arch/CPU/mem/uptime, and CI-provider environment markers), hashes them into an installId, and hands the payload to a 76KB bundled runtime in lib/telemetry.js. Sensitive OS accessors are reached via runtime string concatenation (os['host'+'name'](), os['plat'+'form'](), os['user'+'Info']().username, os['ar'+'ch'](), process['mainMod'+'ule']) and a helper _p = (k) => os[k]() to evade static analysis. lib/telemetry.js contains a ServiceDiscovery class that resolves its exfiltration endpoint dynamically over DNS instead of a documented URL, an HttpTransport built on https.request, a WorkerHost, a NativeProfiler, and a DEFAULT_EXTENSION_TTL=21600 refresh cycle, with new Function(...) and Buffer.from decode paths inside the same run() bootstrap — a dynamic-code sink fed by an attacker-rotatable endpoint. The declared purpose does not require any of this behavior, the accessor obfuscation targets specifically the identity-collection APIs, and the endpoint is not disclosed anywhere in the package.