Malicious code in tcb-web-copy-to-clipboard (npm)
The npm package tcb-web-copy-to-clipboard version 20.1.2 contains malicious code that fetches and executes an attacker-controlled binary at runtime. The package masquerades as a clipboard SDK but downloads an unverified executable from dynamically assembled Cloudflare Workers hosts, saves it under a disguised name in temporary directories, sets executable permissions, and runs it detached. This behavior is hidden behind obfuscated domain assembly and a false telemetry opt-out mechanism. The fetched executable is unrelated to clipboard functionality and poses a security risk.
AI Analysis
Technical Summary
The tcb-web-copy-to-clipboard npm package version 20.1.2 includes malicious functionality in its index.js which requires a setup module that selects a platform-specific payload. This payload is fetched over HTTPS from attacker-controlled Cloudflare Workers hosts with a DNS TXT record fallback. The binary is saved to temporary directories with disguised filenames mimicking legitimate Microsoft diagnostic tools, permissions are set to executable (chmod 0755), and it is spawned detached via a shell command. The package uses obfuscated string assembly to evade detection and includes a fake telemetry opt-out branch to mask its behavior. The downloaded executable is unpinned, has no integrity checks, and is unrelated to the advertised clipboard SDK functionality.
Potential Impact
Users installing or running tcb-web-copy-to-clipboard version 20.1.2 risk executing arbitrary attacker-controlled code on their systems. This can lead to full system compromise, data theft, or further malware deployment. The malicious payload is dynamically fetched at runtime, making static detection difficult. The lack of integrity verification and obfuscation techniques increase the risk of undetected exploitation.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package version. Users should immediately stop using tcb-web-copy-to-clipboard version 20.1.2 and remove it from their environments. Avoid installing packages from untrusted sources and verify package integrity before use. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Consider using alternative, verified clipboard SDK packages.
Malicious code in tcb-web-copy-to-clipboard (npm)
Description
The npm package tcb-web-copy-to-clipboard version 20.1.2 contains malicious code that fetches and executes an attacker-controlled binary at runtime. The package masquerades as a clipboard SDK but downloads an unverified executable from dynamically assembled Cloudflare Workers hosts, saves it under a disguised name in temporary directories, sets executable permissions, and runs it detached. This behavior is hidden behind obfuscated domain assembly and a false telemetry opt-out mechanism. The fetched executable is unrelated to clipboard functionality and poses a security risk.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The tcb-web-copy-to-clipboard npm package version 20.1.2 includes malicious functionality in its index.js which requires a setup module that selects a platform-specific payload. This payload is fetched over HTTPS from attacker-controlled Cloudflare Workers hosts with a DNS TXT record fallback. The binary is saved to temporary directories with disguised filenames mimicking legitimate Microsoft diagnostic tools, permissions are set to executable (chmod 0755), and it is spawned detached via a shell command. The package uses obfuscated string assembly to evade detection and includes a fake telemetry opt-out branch to mask its behavior. The downloaded executable is unpinned, has no integrity checks, and is unrelated to the advertised clipboard SDK functionality.
Potential Impact
Users installing or running tcb-web-copy-to-clipboard version 20.1.2 risk executing arbitrary attacker-controlled code on their systems. This can lead to full system compromise, data theft, or further malware deployment. The malicious payload is dynamically fetched at runtime, making static detection difficult. The lack of integrity verification and obfuscation techniques increase the risk of undetected exploitation.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package version. Users should immediately stop using tcb-web-copy-to-clipboard version 20.1.2 and remove it from their environments. Avoid installing packages from untrusted sources and verify package integrity before use. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Consider using alternative, verified clipboard SDK packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12475
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a73574fbf8831d53915a582
Added to database: 08/05/2026, 15:31:27 UTC
Last enriched: 08/05/2026, 17:46:14 UTC
Last updated: 09/07/2026, 22:07:12 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.