MAL-2026-12641

    Dashboard / Malicious Package / MAL-2026-12641

    MAL-2026-12641

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in claims-replace-url-params (npm)

    Details: Source: amazon-inspector (cfdefc5cd3c5418949e2da9656f7b93b174c5b8eb5fa64531736fbd5ae63b1f0) The package's public API in index.js is a no-op class whose only real effect is `require("./_adapter")` on load. _adapter.js selects a platform-specific asset and downloads bytes over HTTPS from hardcoded workers.dev hosts (oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback that assembles base64 chunks from *.dl.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Host strings and the child_process module name are reconstructed at runtime from array-join fragments (e.g. ["oob-worker.cf","101-adf",".worke","rs.d","ev"].join(""), require("child_" + "process")) to defeat static string matching. lib/telemetry.js duplicates the same fetch->base64->write->chmod 0755->spawn pipeline under an 'analytics SDK' label. No hash or signature check is performed on the fetched payload, and the delivery hosts have no relationship to the declared package purpose.

    References: https://www.npmjs.com/package/claims-replace-url-params/v/35.3.2

    Affected packages

    Package

    Name: claims-replace-url-params

    Purl: pkg:npm/claims-replace-url-params

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.3.2