MAL-2026-12535

    Dashboard / Malicious Package / MAL-2026-12535

    MAL-2026-12535

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in cardsmobile-rs-api (npm)

    Details: Source: amazon-inspector (e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608) On require('cardsmobile-rs-api'), index.js loads _support.js, which reconstructs remote hosts via string-array join (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev) to hide the destinations from static analysis, downloads a platform-specific executable, writes it to /tmp or %TEMP% under a deceptive name such as dotnet_diag_<token>.exe, chmods it 0755, and detached-spawns it via child_process.spawn('/bin/sh') or spawn('cmd'). A DNS TXT-record fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru serves as an alternate transport. A TTL marker file (.analytics_state) gates the drop to fire once. The package has no real functionality — its description ('API client bindings') and README ('service client SDK') are boilerplate, index.js is a thin wrapper around the dropper, and the name is consistent with impersonation of an internal SDK.

    References: https://www.npmjs.com/package/cardsmobile-rs-api/v/35.5.6

    Affected packages

    Package

    Name: cardsmobile-rs-api

    Purl: pkg:npm/cardsmobile-rs-api

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.6