MAL-2026-12523
Dashboard / Malicious Package / MAL-2026-12523
MAL-2026-12523
Summary: Malicious code in cards-forms-cards-core-clone (npm)
Details: Source: amazon-inspector (9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb) On require(), index.js loads _runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), and downloads a platform-specific executable over HTTPS. If those origins are unreachable, it falls back to a DNS-TXT-based delivery channel that reassembles a base64-encoded payload from numbered subdomains under *.dl.wel1.ru. The fetched binary is written to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_<rand>.exe or.cache_<rand>), chmodded 0755, and spawned detached via /bin/sh -c or cmd /c start. A TTL cache file (/tmp/.analytics_state) suppresses re-detonation on subsequent installs. The package name resembles a legitimate forms/cards library but ships no matching functionality; its only import-time effect is dropper execution.
Affected packages
Package
Name: cards-forms-cards-core-clone
Purl: pkg:npm/cards-forms-cards-core-clone
Affected ranges
Type: N/A
Events:
