MAL-2026-12636
Dashboard / Malicious Package / MAL-2026-12636
MAL-2026-12636
Summary: Malicious code in claims-person-domain (npm)
Details: Source: amazon-inspector (03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8) On require of the package's main entry, index.js loads./_support.js which selects a platform-specific asset path (linux/darwin/win32), fetches an opaque binary from one of four Cloudflare Workers endpoints whose hostnames are assembled at runtime by joining fragmented string arrays (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), with a DNS-TXT covert-channel fallback via {sdk,ext,pkg,net}.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe. A persistence marker at /tmp/.analytics_state prevents re-execution. A parallel dropper implementation is bundled in lib/telemetry.js (self-labeled 'Analytics SDK', 81KB) that base64-decodes a payload buffer and spawns it the same way; both files use runtime string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. The obfuscation, disguised filenames mimicking diagnostic tooling, DNS-TXT fallback, and dual dropper implementations have no legitimate purpose.
Affected packages
Package
Name: claims-person-domain
Purl: pkg:npm/claims-person-domain
Affected ranges
Type: N/A
Events:
