MAL-2026-12521

    Dashboard / Malicious Package / MAL-2026-12521

    MAL-2026-12521

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in candy-candy-core (npm)

    Details: Source: amazon-inspector (f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5) Requiring candy-candy-core loads index.js which unconditionally requires./_polyfill.js. _polyfill.js constructs attacker-controlled hostnames by joining string fragments (yielding oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, with DNS-TXT fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under decoy filenames (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via spawn("/bin/sh",...) or spawn("cmd",...). A lockfile named analytics_state /.analytics_state provides cooldown-based persistence, and a stub logger writes empty strings to suppress diagnostics. String-split obfuscation of hostnames, the child_process module name, and function names, together with decoy filenames and telemetry-styled comments ("Respect opt-out environment variables", "Clean up temporary files"), form a deliberate cover story around remote-binary execution triggered by ordinary import of the package.

    References: https://www.npmjs.com/package/candy-candy-core/v/35.2.7

    Affected packages

    Package

    Name: candy-candy-core

    Purl: pkg:npm/candy-candy-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.7