Malicious code in pfp-block-independent-iframe (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185) On require of the package, index.js loads _bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four string-obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64-reassembly fallback via *.dl.well1.site, writes the bytes to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns the file detached via /bin/sh -c or cmd /c start. Hostnames are reconstructed at runtime from split fragments joined with.join(""); no hash or signature verification is performed; filenames are disguised as OS diagnostic artifacts; and cover-story comments frame the traffic as analytics/telemetry with opt-out env vars. The tarball additionally ships an unreferenced lib/telemetry.js (~81KB) implementing the same chunked-base64 -> chmod 755 -> spawn /bin/sh -c primitive under an 'analytics SDK' framing. ## Source: ghsa-malware (8afab21233c95b25115b15ecca1c2db5f3d03aaac132d89443c4836cc4d68093) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The pfp-block-independent-iframe npm package version 20.4.9 includes malicious functionality embedded in its index.js and an unreferenced telemetry.js file. When the package is required, it loads _bootstrap.js which dynamically reconstructs obfuscated Cloudflare Workers hostnames to fetch a platform-specific payload. The payload bytes are written to temporary executable files named to resemble OS diagnostic artifacts, permissions are set to executable, and the payload is spawned detached via shell commands. No integrity checks such as hashing or signature verification are performed on the downloaded payload. The package attempts to disguise this malicious activity as analytics or telemetry, including opt-out environment variables as cover. This behavior results in arbitrary code execution on the affected system.
Potential Impact
This malicious package enables remote code execution on the host system by downloading and executing arbitrary payloads without verification. This can lead to full system compromise, data theft, persistence, or further malware deployment. The disguised filenames and obfuscation techniques increase the difficulty of detection.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the affected version (=20.4.9) of the pfp-block-independent-iframe package from their environments. Avoid installing or requiring this package until a trusted, clean version is available. Monitor for suspicious processes or files matching the described behavior. Verify package integrity and source before installation in the future.
Malicious code in pfp-block-independent-iframe (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185) On require of the package, index.js loads _bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four string-obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64-reassembly fallback via *.dl.well1.site, writes the bytes to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns the file detached via /bin/sh -c or cmd /c start. Hostnames are reconstructed at runtime from split fragments joined with.join(""); no hash or signature verification is performed; filenames are disguised as OS diagnostic artifacts; and cover-story comments frame the traffic as analytics/telemetry with opt-out env vars. The tarball additionally ships an unreferenced lib/telemetry.js (~81KB) implementing the same chunked-base64 -> chmod 755 -> spawn /bin/sh -c primitive under an 'analytics SDK' framing. ## Source: ghsa-malware (8afab21233c95b25115b15ecca1c2db5f3d03aaac132d89443c4836cc4d68093) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The pfp-block-independent-iframe npm package version 20.4.9 includes malicious functionality embedded in its index.js and an unreferenced telemetry.js file. When the package is required, it loads _bootstrap.js which dynamically reconstructs obfuscated Cloudflare Workers hostnames to fetch a platform-specific payload. The payload bytes are written to temporary executable files named to resemble OS diagnostic artifacts, permissions are set to executable, and the payload is spawned detached via shell commands. No integrity checks such as hashing or signature verification are performed on the downloaded payload. The package attempts to disguise this malicious activity as analytics or telemetry, including opt-out environment variables as cover. This behavior results in arbitrary code execution on the affected system.
Potential Impact
This malicious package enables remote code execution on the host system by downloading and executing arbitrary payloads without verification. This can lead to full system compromise, data theft, persistence, or further malware deployment. The disguised filenames and obfuscation techniques increase the difficulty of detection.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the affected version (=20.4.9) of the pfp-block-independent-iframe package from their environments. Avoid installing or requiring this package until a trusted, clean version is available. Monitor for suspicious processes or files matching the described behavior. Verify package integrity and source before installation in the future.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12408
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735746bf8831d53915a059
Added to database: 08/05/2026, 15:31:18 UTC
Last enriched: 08/05/2026, 17:33:03 UTC
Last updated: 09/14/2026, 23:04:15 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.