🛡️ MAL-2026-12298 — twork-data-services-proxy-invest-symbols

Malicious code in twork-data-services-proxy-invest-symbols-list (npm)

Source: amazon-inspector

On require() of this package, index.js loads _init.js which immediately downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT base64 fallback via *.dl.well1.site. The fetched bytes are written to a temp path under disguised names (e.g. dotnet_diag_*.exe,.cache_*), chmod 0755, and detached-spawned via /bin/sh -c or cmd.exe start /b. Hostnames are assembled at runtime from split string arrays (e.g. ['oob-worker.cf100-416.w','orkers.','dev'].join('')) to defeat static hostname scanning. Destination is not the publisher's infrastructure, the fetched payload is opaque, and the package name has no legitimate reason to fetch and run a binary at import time. Platform gating, cooldown flag files, and telemetry-styled opt-out env-var names are consistent with a dropper attempting to blend in.