Malicious code in nxify-unic (npm)

The npm package nxify-unic has been identified as containing malicious code that executes automatically when the module is required. Upon import, the package loads _shim.js, which detects the operating system and architecture, then dynamically constructs hostnames at runtime to evade static analysis.

The malicious code downloads platform-matched binaries from attacker-controlled Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked-base64 fallback mechanism. The binaries are written to temporary directories (/var/tmp or %TEMP%) under decoy filenames such as dotnet_diag_.exe or .cache_, given executable permissions (0755), and spawned detached in the background.

The attack executes on module import rather than at a user-invoked entry point, meaning any application that requires nxify-unic will trigger the malicious behavior. The implementation uses runtime string manipulation and TTL caching to evade detection, with an environment variable opt-out mechanism.

This incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.