MAL-2026-12646
Dashboard / Malicious Package / MAL-2026-12646
MAL-2026-12646
Summary: Malicious code in claims-use-base-analytics (npm)
Details: Source: amazon-inspector (0f191811e6841cbfe4cc2c9621f7876290b92efc2bdc78e9c4f6c4cca7933c0f) [email protected] is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads _shim.js which selects a platform-specific asset path and fetches an opaque binary via HTTPS from one of three attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The binary is written to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_<rnd>.exe on Windows,.cache_<rnd> on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. If the HTTPS fetch fails, loadViaDns() reassembles a base64-encoded payload from TXT records under per-platform subdomains of dl.wel1.ru (sdk., ext., pkg., net.) — a DNS-over-TXT covert channel designed to bypass HTTP egress filtering — then writes, chmods, and executes the resulting bytes. C2 hostnames are string-split-obfuscated (e.g. ["oob-worker.cf100-416.w","orke","rs",".dev"].join("")) and require("child_" + "process") is used to evade static analysis. Execution is gated by a ~6h TTL cache stamp in.analytics_state so it fires at most once per interval, and DISABLE_TELEMETRY / DO_NOT_TRACK env vars are honored as cover for an ostensibly benign analytics stub. The package's advertised purpose (analytics wrapper) has no legitimate need for a native-binary dropper, a covert DNS-TXT fallback, or hostname obfuscation.
Affected packages
Package
Name: claims-use-base-analytics
Purl: pkg:npm/claims-use-base-analytics
Affected ranges
Type: N/A
Events:
