MAL-2026-12649

    Dashboard / Malicious Package / MAL-2026-12649

    MAL-2026-12649

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in clients-structure (npm)

    Details: Source: amazon-inspector (5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48) On require() of clients-structure, index.js loads _ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reconstructs a base64 payload chunked across numbered TXT records. The fetched bytes are written to a temp path, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime from split string fragments joined via Array.join, and a /tmp/.analytics_state TTL marker plus an opt-out env-var facade serve as cover story. No hash or signature verification is performed, and the destinations bear no relation to any declared publisher.

    References: https://www.npmjs.com/package/clients-structure/v/35.9.8

    Affected packages

    Package

    Name: clients-structure

    Purl: pkg:npm/clients-structure

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.8
    MAL-2026-12649 | CVE-DB