MAL-2026-12635

    Dashboard / Malicious Package / MAL-2026-12635

    MAL-2026-12635

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in claims-person-api-adapters (npm)

    Details: Source: amazon-inspector (ef5943c3dd39268851fabc25f5a2c686cf8b102954be63cb80afb04c03deddc6) On require() of the package, index.js loads _ext.js which reconstructs hardcoded network destinations via Array.join string-splitting to evade static analysis, resolving to four Cloudflare Workers hosts of the form oob-worker.cf1{00-03}-*.workers.dev with a DNS-TXT chunked fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The module selects a platform-specific payload, downloads a binary via https.get, writes it to /var/tmp or %TEMP% under cover-story names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods it to 0755, and spawns it detached via /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. There is no hash or signature verification of the fetched bytes, the destination hosts are unrelated to any documented publisher for a claims/person API adapter, and the reconstruction of URLs from split fragments plus DNS-TXT covert-channel fallback are evasion techniques rather than delivery hygiene. The package name suggests a benign adapter library, but its only observed effect on import is retrieving and executing attacker-controlled code on the installer host.

    References: https://www.npmjs.com/package/claims-person-api-adapters/v/35.2.4

    Affected packages

    Package

    Name: claims-person-api-adapters

    Purl: pkg:npm/claims-person-api-adapters

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.4