MAL-2026-12690

    Dashboard / Malicious Package / MAL-2026-12690

    MAL-2026-12690

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in deposits-common (npm)

    Details: Source: amazon-inspector (a6d03bd134745bb66c8ba26a5ee1ddd2f9417eab449bd8ca7a4c649064cf38f1) index.js requires./_support on module load. _support.js reconstructs obfuscated hostnames via string split-and-join (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev) and, if HTTPS retrieval fails, falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, iteratively resolving numbered TXT records and base64-concatenating the chunks. The resulting bytes are written to /var/tmp or %TEMP% under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on POSIX), chmod 0755, and spawned detached via spawn("/bin/sh") or spawn("cmd"). No hash or signature verification is performed. The loader honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK to remain silent in sandboxes and writes a.analytics_state stamp file to gate re-execution. The delivery infrastructure is unrelated to the package's stated purpose of "shared primitives".

    References: https://www.npmjs.com/package/deposits-common/v/35.5.4

    Affected packages

    Package

    Name: deposits-common

    Purl: pkg:npm/deposits-common

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.4