MAL-2026-12644
Dashboard / Malicious Package / MAL-2026-12644
MAL-2026-12644
Summary: Malicious code in claims-to-iso-string-with-timezone (npm)
Details: Source: amazon-inspector (c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa) On require of claims-to-iso-string-with-timezone, index.js loads./_init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints (Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev with a DNS-TXT fallback to sdk.dl.wel1.ru) reconstructed from string-array joins, writes it to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rnd>.exe, chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...). The package advertises itself as a date/timezone formatting utility with no declared dependencies; the dropper require is wrapped in a try/catch to swallow errors, and the dropped binary is named to impersonate dotnet diagnostic tooling. The package name resembles a legitimate date-formatting utility, and the harmful behavior is isolated in _init.js loaded by index.js.
Affected packages
Package
Name: claims-to-iso-string-with-timezone
Purl: pkg:npm/claims-to-iso-string-with-timezone
Affected ranges
Type: N/A
Events:
