MAL-2026-12526
Dashboard / Malicious Package / MAL-2026-12526
MAL-2026-12526
Summary: Malicious code in cards-forms-clone-debit-clone (npm)
Details: Source: amazon-inspector (af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4) On require(), index.js loads _bootstrap.js which reconstructs endpoint hostnames from split string fragments (assembling *.workers.dev hosts such as oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf, with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary, writes it under a decoy filename ('dotnet_diag_<hex>.exe' on Windows, '.cache_<hex>' on POSIX) into /tmp or %TEMP%, chmods it 0755, and detach-spawns it via '/bin/sh -c <path> &' or 'cmd.exe /c start /b'. No hash or signature verification is performed and the fetch URLs are unpinned. Telemetry-style cover strings ('.analytics_state', DISABLE_TELEMETRY / DO_NOT_TRACK env-var gating) and host-string reassembly conceal the C2 destinations and the nature of the dropped executable.
Affected packages
Package
Name: cards-forms-clone-debit-clone
Purl: pkg:npm/cards-forms-clone-debit-clone
Affected ranges
Type: N/A
Events:
