🛡️ MAL-2026-12226 — time-webkit-tag

Malicious code in time-webkit-tag (npm)

Source: amazon-inspector

On require of the package, index.js loads _init.js which unconditionally invokes start(). start() selects a platform-specific asset path, assembles CDN hostnames from split string arrays (oob-worker.cf101-adf.workers.dev family, with a *.dl.well1.site DNS-TXT chunked-transfer fallback), fetches an opaque binary over HTTPS, writes it to /var/tmp or %TEMP% under a hidden dot-file or masquerading name (e.g..cache_<rand>, dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with.unref(). No hash or signature verification is performed and the destination hosts are assembled at runtime to evade static string matching. A second dropper implementation in lib/telemetry.js repeats the same fetch/base64-decode/chmod/spawn chain, with the chmodSync and child_process identifiers built via string concatenation (fs["chmod"+"Sync"], "child_"+"process") under an analytics-SDK cover story. The package is advertised as a webkit tag provider and has no legitimate need for this behavior.