MAL-2026-12044
Malicious code in specials-mvno-client (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b) index.js requires _bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev) and *.dl.well1.site subdomains, writes it to /var/tmp or %TEMP% under disguised filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via spawn('/bin/sh', ['-c', <path>+' &']) or cmd.exe /c start /b. Host names are assembled via array.join to defeat literal string matching. A DNS-TXT fallback channel resolves TXT records under c.<domain> and N.<domain>, concatenating base64 chunks to deliver code when HTTPS is unavailable. The module is cloaked with telemetry-shaped naming (.analytics_state state file, comments describing 'CDN negotiation') and honors DISABLE_TELEMETRY / DO_NOT_TRACK / ANALYTICS_OPT_OUT environment variables to skip execution on scrutinized hosts. The fetched bytes are not publisher-hosted, are opaque, and are executed on every install/require of the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for specials-mvno-client (npm). Pin to a known-safe version or switch to an alternative.