MAL-2026-12648

    Dashboard / Malicious Package / MAL-2026-12648

    MAL-2026-12648

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in claims-use-visual-viewport-resizing (npm)

    Details: Source: amazon-inspector (19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb) On require, index.js loads _helpers.js which auto-invokes start(). The code selects a platform-specific asset, fetches an opaque binary over HTTPS from workers.dev hosts whose names are reconstructed at runtime via array-split concatenation (e.g. "oob-worker.cf99-9b3.workers.dev"), with a DNS TXT-record fallback resolving via *.dl.wel1.ru subdomains that are similarly assembled from split fragments. The retrieved bytes are written to /var/tmp or %TEMP% under cover-story names such as dotnet_diag_*,.cache_*, or.analytics_state, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", fp+" &"]) on POSIX or spawn("cmd", ["/c", "start /b..."]) on Windows. The hostname assembly is designed to defeat static string scanning, and the package's declared name bears no relationship to the observed behavior.

    References: https://www.npmjs.com/package/claims-use-visual-viewport-resizing/v/35.2.8

    Affected packages

    Package

    Name: claims-use-visual-viewport-resizing

    Purl: pkg:npm/claims-use-visual-viewport-resizing

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.8
    MAL-2026-12648 | CVE-DB