Malicious code in trapp-configuration (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c) On require('trapp-configuration'), index.js loads _adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three Cloudflare Workers hosts whose hostnames are reconstructed by joining character-split arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /tmp or TEMP under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via child_process spawn against /bin/sh or cmd. There is no hash or signature verification. When the HTTP mirrors are unreachable, _adapter.js falls back to a DNS-TXT covert channel against *.dl.well1.site (c.<domain> returns a chunk count, then numbered TXT queries at N.<domain> are base64-reassembled into the same payload) and executes the reconstructed binary. Hostname string-splitting and system-artifact impersonation in the dropped file names are consistent with deliberate evasion rather than a build helper. ## Source: ghsa-malware (a2d58104b870146d82d76ecd070942f1e053a0bfb1de3ea939fa6a48a285dc94) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The 'trapp-configuration' npm package version 20.5.3 includes a malicious component in its _adapter.js file. This component dynamically constructs hostnames to download an opaque binary from Cloudflare Workers hosts, saves it to temporary directories with disguised filenames, sets executable permissions, and executes it detached via child_process spawn using system shells (/bin/sh or cmd). If the HTTP download fails, it falls back to a covert DNS-TXT channel to retrieve and reconstruct the binary payload from DNS TXT records under the domain *.dl.well1.site. There is no integrity verification of the downloaded binary. The use of hostname string-splitting and disguised filenames suggests intentional evasion rather than benign build behavior.
Potential Impact
This malicious behavior allows arbitrary binary code execution on the host system where the package is installed, potentially leading to full system compromise. The lack of hash or signature verification increases the risk of executing tampered or malicious payloads. The covert DNS-TXT fallback channel further complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using version 20.5.3 of 'trapp-configuration'. Investigate and remove this package from affected environments. Monitor for any binaries or processes spawned from temporary directories with suspicious names. Check vendor advisories or trusted sources for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in trapp-configuration (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c) On require('trapp-configuration'), index.js loads _adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three Cloudflare Workers hosts whose hostnames are reconstructed by joining character-split arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /tmp or TEMP under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via child_process spawn against /bin/sh or cmd. There is no hash or signature verification. When the HTTP mirrors are unreachable, _adapter.js falls back to a DNS-TXT covert channel against *.dl.well1.site (c.<domain> returns a chunk count, then numbered TXT queries at N.<domain> are base64-reassembled into the same payload) and executes the reconstructed binary. Hostname string-splitting and system-artifact impersonation in the dropped file names are consistent with deliberate evasion rather than a build helper. ## Source: ghsa-malware (a2d58104b870146d82d76ecd070942f1e053a0bfb1de3ea939fa6a48a285dc94) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'trapp-configuration' npm package version 20.5.3 includes a malicious component in its _adapter.js file. This component dynamically constructs hostnames to download an opaque binary from Cloudflare Workers hosts, saves it to temporary directories with disguised filenames, sets executable permissions, and executes it detached via child_process spawn using system shells (/bin/sh or cmd). If the HTTP download fails, it falls back to a covert DNS-TXT channel to retrieve and reconstruct the binary payload from DNS TXT records under the domain *.dl.well1.site. There is no integrity verification of the downloaded binary. The use of hostname string-splitting and disguised filenames suggests intentional evasion rather than benign build behavior.
Potential Impact
This malicious behavior allows arbitrary binary code execution on the host system where the package is installed, potentially leading to full system compromise. The lack of hash or signature verification increases the risk of executing tampered or malicious payloads. The covert DNS-TXT fallback channel further complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using version 20.5.3 of 'trapp-configuration'. Investigate and remove this package from affected environments. Monitor for any binaries or processes spawned from temporary directories with suspicious names. Check vendor advisories or trusted sources for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12485
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735747bf8831d53915a0bb
Added to database: 08/05/2026, 15:31:19 UTC
Last enriched: 08/05/2026, 17:38:14 UTC
Last updated: 09/07/2026, 22:13:17 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.