Malicious code in travel-core-typings-reducers (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245) On require() of the package, index.js loads _ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416, cf101-adf, cf103-070) with a DNS-TXT covert-channel fallback against subdomains of dl.well1.site (tin/ldr/win.dl.well1.site) that reassembles base64 chunks into executable bytes. The fetched payload is written to /var/tmp or %TEMP% under disguised names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod +x'd, and spawned detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true}) or spawn("cmd",...). C2 hostnames are assembled at runtime via ["oob-work","er.cf103-07","0.workers.","dev"].join("") to defeat static string search. The package presents itself as a base framework typings module and ships an unreferenced lib/telemetry.js plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out env vars as cover; the DNS-TXT path carries an inline comment describing it as chunked transfer for environments blocking HTTPS. ## Source: ghsa-malware (a0c5ac14d5ca2237a244551a8668e466e4f83d359a930dc35e57543405e4c14c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The malicious npm package travel-core-typings-reducers (version 20.7.8) executes a multi-stage attack by loading an auxiliary script (_ext.js) that downloads a platform-specific binary payload from runtime-assembled Cloudflare workers.dev hostnames. The payload is also retrievable via a DNS-TXT covert channel fallback from subdomains of dl.well1.site, which reassembles base64-encoded chunks into executable code. The payload is saved to temporary directories with disguised filenames, made executable, and launched detached from the main process using shell commands. The package attempts to evade detection by dynamically constructing C2 hostnames and including unreferenced telemetry-related code and environment variables as decoys.
Potential Impact
Successful execution of this malicious package results in arbitrary code execution on the host system, potentially allowing attackers to run unauthorized binaries with the privileges of the user running the npm package. The use of covert DNS-TXT channels and dynamic hostname assembly complicates detection and analysis. This can lead to system compromise, persistence, and further malicious activity.
Mitigation Recommendations
No official patch or remediation guidance is provided for this malicious package. Users should avoid installing or using travel-core-typings-reducers version 20.7.8. If already installed, remove the package immediately and scan affected systems for the presence of the downloaded payloads in temporary directories. Monitor for suspicious processes spawned from temporary locations. Employ supply chain security best practices such as verifying package integrity and using trusted sources.
Malicious code in travel-core-typings-reducers (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245) On require() of the package, index.js loads _ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416, cf101-adf, cf103-070) with a DNS-TXT covert-channel fallback against subdomains of dl.well1.site (tin/ldr/win.dl.well1.site) that reassembles base64 chunks into executable bytes. The fetched payload is written to /var/tmp or %TEMP% under disguised names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod +x'd, and spawned detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true}) or spawn("cmd",...). C2 hostnames are assembled at runtime via ["oob-work","er.cf103-07","0.workers.","dev"].join("") to defeat static string search. The package presents itself as a base framework typings module and ships an unreferenced lib/telemetry.js plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out env vars as cover; the DNS-TXT path carries an inline comment describing it as chunked transfer for environments blocking HTTPS. ## Source: ghsa-malware (a0c5ac14d5ca2237a244551a8668e466e4f83d359a930dc35e57543405e4c14c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The malicious npm package travel-core-typings-reducers (version 20.7.8) executes a multi-stage attack by loading an auxiliary script (_ext.js) that downloads a platform-specific binary payload from runtime-assembled Cloudflare workers.dev hostnames. The payload is also retrievable via a DNS-TXT covert channel fallback from subdomains of dl.well1.site, which reassembles base64-encoded chunks into executable code. The payload is saved to temporary directories with disguised filenames, made executable, and launched detached from the main process using shell commands. The package attempts to evade detection by dynamically constructing C2 hostnames and including unreferenced telemetry-related code and environment variables as decoys.
Potential Impact
Successful execution of this malicious package results in arbitrary code execution on the host system, potentially allowing attackers to run unauthorized binaries with the privileges of the user running the npm package. The use of covert DNS-TXT channels and dynamic hostname assembly complicates detection and analysis. This can lead to system compromise, persistence, and further malicious activity.
Mitigation Recommendations
No official patch or remediation guidance is provided for this malicious package. Users should avoid installing or using travel-core-typings-reducers version 20.7.8. If already installed, remove the package immediately and scan affected systems for the presence of the downloaded payloads in temporary directories. Monitor for suspicious processes spawned from temporary locations. Employ supply chain security best practices such as verifying package integrity and using trusted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12486
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735747bf8831d53915a088
Added to database: 08/05/2026, 15:31:19 UTC
Last enriched: 08/05/2026, 17:35:50 UTC
Last updated: 09/14/2026, 03:36:18 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.