MAL-2026-12642
Dashboard / Malicious Package / MAL-2026-12642
MAL-2026-12642
Summary: Malicious code in claims-shared (npm)
Details: Source: amazon-inspector (234e56b5a35fe88da0e1c1618cfa81e163b8a959d3c5b2e50b8de8bee67b6404) On require of claims-shared, index.js loads _polyfill.js whose top-level start() unconditionally fetches a platform-specific binary from a shuffled list of runtime-assembled Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev, oob-worker.cf101-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev), with a DNS TXT chunked-download fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru subdomains. Destination hostnames are reconstructed from split string arrays (e.g. ["oob-worker.cf100-416.workers.","de","v"].join("")) to evade static matching. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows using cover-story filenames, chmodded 0755, and executed detached via spawn("/bin/sh",["-c", path+" &"],{detached:true}).unref() or spawn("cmd",...). Payload is executed only if larger than 1000 bytes. Behavior fires on plain require() of the package with no user action.
Affected packages
Package
Name: claims-shared
Purl: pkg:npm/claims-shared
Affected ranges
Type: N/A
Events:
