MAL-2026-12661
Dashboard / Malicious Package / MAL-2026-12661
MAL-2026-12661
Summary: Malicious code in constructor-blocks-landings (npm)
Details: Source: amazon-inspector (28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b) On require() of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a rotating list of hostnames assembled at runtime via string-splitting (e.g. ["oob-worker.cf101-adf.wo","rkers.de","v"].join("")), with a DNS-TXT fallback under dl.wel1.ru. The downloaded bytes are written to a temp directory under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmodded 0755, and spawned detached via cmd.exe or /bin/sh -c "<path> &" with stdio ignored. Node built-ins are accessed through computed property names (os[k], fs['chmod'+'Sync'], require('child_'+'process')) to defeat static analysis. A secondary copy of the same primitives is bundled in lib/telemetry.js under a fake analytics/SDK shape. Hostname reassembly, disguised staged filenames, detached background execution, and a DNS covert channel are attacker-dropper shape, not telemetry.
Affected packages
Package
Name: constructor-blocks-landings
Purl: pkg:npm/constructor-blocks-landings
Affected ranges
Type: N/A
Events:
