MAL-2026-12536
Dashboard / Malicious Package / MAL-2026-12536
MAL-2026-12536
Summary: Malicious code in cardsmobile-storage (npm)
Details: Source: amazon-inspector (c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b) On require(), index.js loads _shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded binary is written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the file is spawned detached and unref'd via /bin/sh -c or cmd.exe/start. Host names and the child_process module name are assembled at runtime from split-string arrays (require("child_" + "process"), ["oob-worke","r.cf99-9b3",".wor","kers.d","ev"].join("")) to evade static URL/module scanners. A parallel dropper implementation with the same primitives (HTTPS with endpoint rotation, DNS-TXT base64 service discovery, fs.chmodSync 0o755, cp.spawn("/bin/sh", ["-c", filePath + " &"])) is bundled in lib/telemetry.js (81 KB, labeled as an "Analytics SDK") and shipped in the tarball as an alternate execution path.
Affected packages
Package
Name: cardsmobile-storage
Purl: pkg:npm/cardsmobile-storage
Affected ranges
Type: N/A
Events:
