MAL-2026-12534
Dashboard / Malicious Package / MAL-2026-12534
MAL-2026-12534
Summary: Malicious code in cardsmobile-notifications (npm)
Details: Source: amazon-inspector (5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2) On require() of cardsmobile-notifications, index.js loads _support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT covert-channel fallback that assembles a base64 payload from numbered subdomains under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). No hash or signature verification is performed; the destinations are not the publisher; the C2 hostnames are assembled via string-split.join("") to evade static matching. A second 81KB module lib/telemetry.js, disguised as an APM/telemetry SDK, contains the same base64-decode + chmod 0755 + /bin/sh spawn pattern; it is not reached from index.js in this version but is armed and could be re-wired by a future release.
Affected packages
Package
Name: cardsmobile-notifications
Purl: pkg:npm/cardsmobile-notifications
Affected ranges
Type: N/A
Events:
