🛡️ MAL-2026-12300 — twork-data-services-role-app

Malicious code in twork-data-services-role-app (npm)

Source: amazon-inspector

On require(), index.js loads _init.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts assembled via split-string obfuscation (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev). The binary is written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via spawn("/bin/sh", ["-c", path + " &"], {detached:true}) or spawn("cmd",...). When HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel at c.<domain> / N.<domain> under *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), concatenates base64-encoded TXT chunks, and executes the reconstructed bytes with no verification. Host strings and the child_process module name are reconstructed from split fragments (e.g. ["oob-work","er.cf102-baf.","workers.de","v"].join(""); require("child_" + "process")) to evade static analysis. Installing or requiring this package auto-executes attacker-controlled code on the installer's machine.