{"answers":{"affected":"1 open source package ship an affected version, including arbocrate-sla-prober-arbocrate-sla-prober-core.","exploited":"There is no known exploitation of MAL-2026-12140 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12140 is a malicious package in arbocrate-sla-prober-arbocrate-sla-prober-core, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12140 is a malicious package: arbocrate-sla-prober-arbocrate-sla-prober-core (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12140/ (Markdown: https://insights.sbomify.com/MAL-2026-12140/index.md)","id":"MAL-2026-12140","markdown":"https://insights.sbomify.com/MAL-2026-12140/index.md","name":"MAL-2026-12140","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require() of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (package-proxy.cf5oobworker.workers.dev, package-proxy.cf8oobworker.workers.dev, package-proxy.cf12oobworker.workers.dev, package-proxy.cf17-ddb.workers.dev, package-proxy.cf25-6eb.workers.dev) and fallback hosts under well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe, writes the fetched bytes to a temp path, chmods 0755, and executes them via child_process. The sensitive APIs and destination hostnames are reconstructed at runtime through string concatenation and array-join tricks (require(\"child_\"+\"process\"), os[\"plat\"+\"form\"], fs[\"chmod\"+\"Sync\"], hostnames assembled from split fragments) to evade static keyword scanners. Before contacting the remote hosts, setup.js hashes hostname, OS username, cwd, node version, and pid into an install fingerprint and passes it to the transport as an installId, letting the operator track each installer host receiving the payload. Destinations are anonymous Cloudflare Workers subdomains and a lookalike well1.site host, unrelated to any legitimate publisher infrastructure; fetched content is unversioned, unhashed, and unsigned.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in arbocrate-sla-prober-arbocrate-sla-prober-core (npm)","id":"MAL-2026-12140","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"arbocrate-sla-prober-arbocrate-sla-prober-core","purl":"pkg:npm/arbocrate-sla-prober-arbocrate-sla-prober-core","source":"MAL-2026-12140"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12140/"}