MAL-2026-13281
Dashboard / Malicious Package / MAL-2026-13281
MAL-2026-13281
Summary: Malicious code in docsmate-docsmate-core (npm)
Details: Source: amazon-inspector (9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e) On require(), index.js loads _support.js which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf, cf102-baf) from split string fragments, with a DNS-TXT fallback resolver chain across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. It downloads an OS/arch-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods 0755, and detaches it via spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or spawn('cmd',...). A stamp file suppresses re-runs and environment variables can disable execution. The package presents itself as a platform/core types library and ships no shipped native source that would justify fetching and executing an opaque binary at import time. Destination hosts are string-obfuscated to evade static inspection, and the dropped file is named to impersonate a Microsoft.NET diagnostic tool.
Affected packages
Package
Name: docsmate-docsmate-core
Purl: pkg:npm/docsmate-docsmate-core
Affected ranges
Type: N/A
Events:
