MAL-2026-12529
Dashboard / Malicious Package / MAL-2026-12529
MAL-2026-12529
Summary: Malicious code in cardsmobile-cardsmobile-core (npm)
Details: Source: amazon-inspector (657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30) On require() of cardsmobile-cardsmobile-core, index.js loads _shim.js which selects a platform-specific payload path, fetches an unsigned executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes it to a hidden path under /var/tmp or %TEMP% with decoy names (dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns it detached via /bin/sh or cmd.exe. A cooldown lockfile at /tmp/.analytics_state prevents re-runs. Endpoint hostnames and dangerous API names are assembled at runtime via.join('') from string fragments (e.g. require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis, and lib/telemetry.js additionally decodes a base64 payload before executing it. A DISABLE_TELEMETRY environment check is present but does not gate the dropper. Loading this package grants remote code execution on the installer's host with detached persistence beyond the Node process.
Affected packages
Package
Name: cardsmobile-cardsmobile-core
Purl: pkg:npm/cardsmobile-cardsmobile-core
Affected ranges
Type: N/A
Events:
