🛡️ MAL-2026-12302 — twork-data-services-sme-operations-autho

Malicious code in twork-data-services-sme-operations-authorizations (npm)

Source: amazon-inspector

On require of the package, index.js loads _compat.js which fetches a platform-specific binary from hostnames assembled by array-join to hide them from static scanners (oob-worker.cf102-baf.workers.dev, cf100-416.workers.dev, cf103-070.workers.dev, cf99-9b3.workers.dev), with a DNS TXT base64 chunked fallback via *.dl.well1.site resolvers. The fetched bytes are written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start. No hash or signature verification is performed on the downloaded binary. A parallel dropper implementation in lib/telemetry.js uses the same pattern (child_process required via string concatenation, chmodSync accessed via computed property name, base64-decoded payload buffer, detached shell spawn). The package declares no legitimate purpose that would justify fetching and executing an unsigned remote binary at import time.