MAL-2026-12626

    Dashboard / Malicious Package / MAL-2026-12626

    MAL-2026-12626

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in claims-is-mobile-layout (npm)

    Details: Source: amazon-inspector (b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b) On require() of the package, index.js unconditionally loads./_vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTPS, writes it to /tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime via Array.join over split string literals (e.g. 'oob-worker.cf102-baf.workers.dev' on anonymous Cloudflare Workers subdomains) to evade static URL/domain scanning. A DNS-TXT covert-channel fallback under *.dl.wel1.ru chunks a base64 payload across numbered TXT records, reassembles it, and decodes it as executable content. The dropped binary is staged under cover-story names ('analytics_state', 'dotnet_diag_*') that do not match the package's advertised 'mobile layout' purpose.

    References: https://www.npmjs.com/package/claims-is-mobile-layout/v/35.4.3

    Affected packages

    Package

    Name: claims-is-mobile-layout

    Purl: pkg:npm/claims-is-mobile-layout

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.4.3
    MAL-2026-12626 | CVE-DB