🛡️ MAL-2026-12414 — pfp-forms-sme-loan

Malicious code in pfp-forms-sme-loan (npm)

Source: amazon-inspector

On require of the package, index.js loads _bridge.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers subdomains whose hostnames are reassembled at runtime via Array.join() to defeat static analysis (e.g. ["oob-worker.cf100-416.workers.de","v"].join("") and ["tin.dl.","well1.s","it","e"].join("")), with a DNS TXT record fallback that reassembles the payload from covert-channel responses. The fetched bytes are written to a temp path under a disguised name (dotnet_diag_*.exe /.cache_*), chmodded 0o755, and executed detached via spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() on Unix or spawn("cmd",...) on Windows. A companion module lib/telemetry.js (not currently wired into the require graph) contains a fuller variant of the same fetch/decode/spawn logic behind a Sentry-style "analytics SDK" cover story, using string concatenation to hide dangerous APIs (require("child_" + "process"), fs["chmod" + "Sync"]). Requiring or installing the package results in execution of attacker-controlled bytes on the installer's host.