MAL-2026-12390

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hubert-document-actual-insurance-rules-am/MAL-2026-12390.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12390
Published
2026-08-05T12:35:59Z
Modified
2026-08-05T13:35:31.606881244Z
Summary
Malicious code in hubert-document-actual-insurance-rules-am (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc)

On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback under *.dl.well1.site. The hostnames are assembled at runtime by splitting and joining string fragments to hide them from static analysis. The fetched binary is written to a disguised path in /tmp or %TEMP% (e.g. dotnetdiag<hex>.exe or.cache<hex>), chmodded 0o755 on POSIX, and spawned detached via /bin/sh -c or cmd. Cover-story identifiers such as analyticsstate, DISABLETELEMETRY, and dotnetdiag frame the behavior as telemetry, but the actual code path is a fetch-and-execute dropper of attacker-controlled binaries that fires on module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014722",
            "import_time": "2026-08-05T13:08:40.83527474Z",
            "sha256": "074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc",
            "modified_time": "2026-08-05T12:35:59Z",
            "versions": [
                "20.5.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / hubert-document-actual-insurance-rules-am

Package

Name
hubert-document-actual-insurance-rules-am
View open source insights on deps.dev
Purl
pkg:npm/hubert-document-actual-insurance-rules-am

Affected ranges

Affected versions

20.*
20.5.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-KKoMX7+t/JTM6Zoax5AVcc+/mlSK6icithZtejKuhPlHrQINurAnHlxVNotrmcsb1Gc0yVoo8Lw+SlaajzTVuw==",
                "sha1": "18b0ee6a4cfce08327f0374c10f7e79998a1d0e7"
            },
            "filename": "hubert-document-actual-insurance-rules-am-20.5.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "6b790f245b20afa79fdccea17f1d7d73f43c3fdc8a998e2e3c99fbbec6b733ab",
            "path": "_helpers.js",
            "tlsh": "98a1855e066a70198bb0d7e4db174416f65bf6533380c280fb6ca9985f7212483b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hubert-document-actual-insurance-rules-am/MAL-2026-12390.json"