Malicious code in sso-tramvai-module-context-auth (npm)

The npm package sso-tramvai-module-context-auth was found to contain malicious code that executes on module load. When required, the package's index.js loads _vendor.js, which reconstructs attacker-controlled hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a *.dl.well1.site DNS-TXT fallback channel) to evade static string matching detection.

The malicious code downloads a platform-specific binary and writes it to /var/tmp/.cache_ on Unix systems or %TEMP%/dotnet_diag_.exe on Windows, then executes it detached from the Node process using shell commands (/bin/sh -c or cmd.exe /c start /b) with stdio redirected. The execution is gated by opt-out environment variables and a TTL-based state-file cache to reduce visibility of repeated execution.

The package name closely resembles legitimate packages in the tramvai ecosystem, likely intended to deceive developers. The fetched binary, its command-and-control infrastructure, and the drop-and-execute behavior are unrelated to any authentication token functionality that the package advertises.

This incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-frm7-83xc-2wp6.