MAL-2026-12610
Dashboard / Malicious Package / MAL-2026-12610
MAL-2026-12610
Summary: Malicious code in claims-claims-api-adapters (npm)
Details: Source: amazon-inspector (dbf35d865ef56cd2fa5863a636bb33bf43d7afe418e9028c3bb73af13470bf63) On require, index.js loads _loader.js which selects a platform-specific temp path, downloads a binary over HTTPS from anonymous *.workers.dev hosts whose names are reconstructed at runtime by joining split string fragments (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes the bytes to a stealth filename (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Linux/macOS), chmods 0755, and spawns it detached via /bin/sh -c or cmd. If HTTPS retrieval fails, the loader falls back to a covert DNS-TXT channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, requesting c.<domain> for a chunk count and <i>.<domain> for up to 2000 base64 chunks, concatenating and base64-decoding the result into the payload buffer that is then written and executed. No hash or signature verification is performed; destination hostnames are obfuscated to evade static inspection.
Affected packages
Package
Name: claims-claims-api-adapters
Purl: pkg:npm/claims-claims-api-adapters
Affected ranges
Type: N/A
Events:
