Malicious code in hubert-appointment-v2-task-create-am (npm)
The npm package hubert-appointment-v2-task-create-am contained malicious code that downloads and executes unsigned platform-specific binaries from attacker-controlled Cloudflare Workers domains on module load. The malicious payload is disguised as telemetry/analytics functionality.
- Disclosed
- Last updated
- Blast radius
- All users of hubert-appointment-v2-task-create-am npm package
- Ecosystems
- Attack vectors
- Affected entities
- hubert-appointment-v2-task-create-amnpm package containing malicious code
The npm package hubert-appointment-v2-task-create-am was found to contain malicious code in its platform.js module. Upon require(), the code reconstructs hostnames from obfuscated string arrays and downloads unsigned, platform-specific binaries from attacker-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback mechanism through *.dl.well1.site domains.\n\nThe downloaded binary is written to /var/tmp/.cache on Linux or to the Windows TEMP directory as dotnet_diag_.exe, given execute permissions (0755), and spawned detached via shell commands. The malicious activity is disguised as telemetry/analytics functionality with a DO_NOT_TRACK opt-out and cooldown marker to evade detection.\n\nNo cryptographic verification (hash or signature) is performed on the fetched binaries, allowing arbitrary code execution on affected systems. The incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-62xx-7cqv-qp4g.
Indicators of compromise
- Packages
- hubert-appointment-v2-task-create-am
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- tin.dl.well1.site
Remediation
- Immediately remove or uninstall the hubert-appointment-v2-task-create-am package from all affected systems
- Audit systems that had this package installed for signs of unauthorized binary execution or network connections to the identified Cloudflare Workers domains
- Block outbound connections to *.workers.dev and *.dl.well1.site at the network level
- Review package dependencies to ensure no other packages depend on hubert-appointment-v2-task-create-am
- Implement package integrity verification and supply chain security scanning in your npm dependency management
Sources
- GitHub Advisory GHSA-62xx-7cqv-qp4g · GitHub Advisory Database
Cite this entry
"Malicious code in hubert-appointment-v2-task-create-am (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-hubert-appointment-v2-task-create-am-npm-pz42qs
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package