MAL-2026-12647
Dashboard / Malicious Package / MAL-2026-12647
MAL-2026-12647
Summary: Malicious code in claims-use-callback-once (npm)
Details: Source: amazon-inspector (0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1) On require() of claims-use-callback-once, index.js unconditionally loads _shim.js which selects a platform-specific payload path, fetches an executable from one of several hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback over *.dl.wel1.ru (ext./pkg./net.dl.wel1.ru), writes the payload to /tmp or %TEMP% under a deceptive Microsoft-diagnostics-style name (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. Host strings and sensitive Node API names (child_process, chmodSync) are assembled at runtime via array joins and string concatenation to evade static analysis. lib/telemetry.js bundles a parallel dropper implementation (DNS TXT base64 payload assembly, chmod 0755, detached shell spawn) presented as an 'Analytics SDK' cover story. The package name resembles a callback utility but the shipped code has no such functionality.
Affected packages
Package
Name: claims-use-callback-once
Purl: pkg:npm/claims-use-callback-once
Affected ranges
Type: N/A
Events:
