🛡️ MAL-2026-12421 — pvm-autodoc

Malicious code in pvm-autodoc (npm)

Source: amazon-inspector

On require('pvm-autodoc'), index.js loads _bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT base64 chunked fallback under *.dl.well1.site. The destination hostnames are constructed by string-splitting and joining at runtime to evade static analysis. The fetched bytes are written to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows (a name mimicking a Microsoft diagnostic tool), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. Opt-out variables and file naming are framed as 'analytics'/'telemetry' while the actual behavior is fetch-and-execute of an unpinned, unverified opaque native binary. A second file, lib/telemetry.js, is shipped in the tarball with the same fetch-decode-chmod-spawn primitives using concatenated API names ('child_'+'process', 'chmod'+'Sync') as a companion payload.