MAL-2026-12619
Dashboard / Malicious Package / MAL-2026-12619
MAL-2026-12619
Summary: Malicious code in claims-get-base-url (npm)
Details: Source: amazon-inspector (7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106) index.js requires./setup on load, so any require() of this package triggers a dropper chain. setup.js selects a platform-specific payload path (linux/darwin/win32), downloads a binary over HTTPS from string-split-obfuscated hosts of the form oob-worker.cf10X-*.workers.dev with a DNS TXT-record fallback channel under sdk.dl.wel1.ru (hostnames are assembled at runtime via array joins such as ["oob-worker.cf102-baf.workers.de","v"].join("") to hide the.dev TLD from static scanners), writes it to a hidden path under /var/tmp or %TEMP% (.cache_<hex> / dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref()'d. lib/telemetry.js contains a second, dormant copy of the same dropper shape (base64 chunk assembly, chmod 0755, detached /bin/sh spawn), referencing child_process as 'child_'+'process'. The package's advertised purpose ("claims get base url interface") has no legitimate need for cross-platform binary fetch-and-execute; the obfuscation, DNS fallback channel, and hidden dotfile staging are canonical import-time dropper tradecraft. Installing and loading this package runs attacker-controlled native code on the installer's machine.
Affected packages
Package
Name: claims-get-base-url
Purl: pkg:npm/claims-get-base-url
Affected ranges
Type: N/A
Events:
