🛡️ MAL-2026-12380 — fb-forms-form-boilerplate-contacts

Malicious code in fb-forms-form-boilerplate-contacts (npm)

Source: amazon-inspector

Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires _init.js, which on load downloads a platform-specific binary from author-controlled Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback channel over well1.site subdomains (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). Endpoint hostnames are reconstructed at runtime via array.join('') splits to defeat static analysis. The downloaded bytes are written to /tmp or the Windows TEMP directory under disguised names (.cache_<uid>, dotnet_diag_<uid>.exe), chmodded 0755, and spawned detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true,stdio:'ignore'}) with no hash or signature verification. A /tmp/.analytics_state stamp file provides per-TTL dedup. A sibling lib/telemetry.js (81KB, not currently reached from index.js) mirrors the same dropper primitives (HTTPS endpoint rotation, DNS-based service discovery, base64 Buffer.from chunks, fs.chmodSync 0755, cp.spawn /bin/sh detached), staged for future activation. On npm install followed by any require of this package, an opaque attacker-controlled native executable runs with the installer's privileges.