MAL-2026-12625

    Dashboard / Malicious Package / MAL-2026-12625

    MAL-2026-12625

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in claims-historical-claims-domain (npm)

    Details: Source: amazon-inspector (821551bfee1b6a8fa74b001808fad75327d22654f228600f02a6130edc31ce2e) On require, index.js loads _bridge.js which selects a platform-specific URL path and downloads a binary via https.get from hostnames assembled by string-splitting fragments such as 'oob-worker.cf*-*.workers.dev', with a DNS TXT-record base64 fallback under '*.dl.wel1.ru'. The fetched bytes are written to a temp file under a masquerading name (dotnet_diag_<rnd>.exe on Windows,.cache_<rnd> on Unix), chmodded 0755, and spawned detached via /bin/sh -c or cmd. No hash or signature verification is performed. A freshness marker file named 'analytics_state' gates re-runs to roughly once per six hours, and code comments frame the behavior as 'telemetry'/'analytics'. Host destinations and artifact names are obfuscated via array-join string splitting to defeat literal-string scanning.

    References: https://www.npmjs.com/package/claims-historical-claims-domain/v/35.4.4

    Affected packages

    Package

    Name: claims-historical-claims-domain

    Purl: pkg:npm/claims-historical-claims-domain

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.4.4
    MAL-2026-12625 | CVE-DB