MAL-2026-12614
Dashboard / Malicious Package / MAL-2026-12614
MAL-2026-12614
Summary: Malicious code in claims-enums (npm)
Details: Source: amazon-inspector (b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e) On require('claims-enums'), index.js loads _polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS-TXT chunked fallbacks resolved from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to /tmp or %TEMP% under cover-story filenames (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmod'd 0755, and detach-spawned via /bin/sh or cmd.exe. Hostnames, the child_process import, and fs.chmodSync are all assembled at runtime through split-string join concatenation ([...].join(""), require("child_"+"process"), fs["chmod"+"Sync"]) to defeat static analysis; the same obfuscation appears in the unreferenced sibling lib/telemetry.js. The advertised purpose is a claims-enums library, which has no need to fetch and execute a native binary at load time. A DISABLE_TELEMETRY environment check is present as cover framing.
Affected packages
Package
Name: claims-enums
Purl: pkg:npm/claims-enums
Affected ranges
Type: N/A
Events:
