MAL-2026-12611
Dashboard / Malicious Package / MAL-2026-12611
MAL-2026-12611
Summary: Malicious code in claims-constants (npm)
Details: Source: amazon-inspector (b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b) The package's index.js unconditionally requires./_helpers.js, whose top-level main() executes on import. It downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). Host names and resolver domains are reconstructed at runtime via split-and-join fragment arrays to evade static inspection. The DNS-TXT fallback fetches a chunk count from c.<domain>, iterates N.<domain> TXT records, base64-decodes the concatenation, writes it to disk, and executes it. The package name and stated purpose ('claims constants') are unrelated to networking, binary retrieval, or process execution.
Affected packages
Package
Name: claims-constants
Purl: pkg:npm/claims-constants
Affected ranges
Type: N/A
Events:
