MAL-2026-12537

Dashboard / Malicious Package / MAL-2026-12537

MAL-2026-12537

Summary: Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

Details: Source: amazon-inspector (4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb) index.js unconditionally requires./_loader on module load. _loader.js assembles three Cloudflare Workers hostnames via split-array `.join("")` obfuscation (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), fetches an opaque platform-specific native binary via `https.get`, writes it to /var/tmp or %TEMP% under a decoy name (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0755, and spawns it detached via `cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref()` (or `spawn("cmd",...)` on Windows). A secondary DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru reconstructs a base64-encoded payload from numbered TXT records (`c.<domain>` count + `<i>.<domain>` chunks) when the HTTPS fetch fails. The binary is unpinned, unhashed, and served from anonymous Workers subdomains — arbitrary attacker-controlled code executes on any host that installs or requires the package. lib/telemetry.js contains parallel dropper primitives (split-string `require("child_" + "process")`, `fs["chmod" + "Sync"]`, `cp.spawn("/bin/sh",...)`) staged but not currently reachable from the main entry.

References: https://www.npmjs.com/package/cbp-exchange-government-cbp-exchange-government-core/v/35.3.3