MAL-2026-12520

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/caen-caen-core/MAL-2026-12520.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12520
Published
2026-08-05T14:17:39Z
Modified
2026-08-05T14:35:17.333751815Z
Summary
Malicious code in caen-caen-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6)

The package's main entry (index.js) loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS-TXT base64 fallback resolving via {sdk,ext,pkg,net}.dl.wel1.ru, writes it to /tmp or %TEMP% under deceptive names (.cache<hex>, dotnetdiag<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Hostnames are reconstructed at runtime by Array.join over split string fragments to evade static analysis, and the module presents an 'analytics'/telemetry cover story with DISABLETELEMETRY-style env gates. A secondary dropper in lib/telemetry.js contains the same shape with additional obfuscation: require("child_" + "process"), Buffer.from(chunks, "base64"), fs["chmod"+"Sync"], and cp.spawn("/bin/sh", ["-c", filePath + " &"]). The fetched destinations and delivered binaries are unrelated to the stated 'platform core' purpose, giving whoever controls the C2 arbitrary code execution on any machine that installs or requires this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6",
            "id": "IN-MAL-2026-015243",
            "modified_time": "2026-08-05T14:17:39Z",
            "import_time": "2026-08-05T14:20:16.038897316Z",
            "source": "amazon-inspector",
            "versions": [
                "35.5.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / caen-caen-core

Package

Name
caen-caen-core
View open source insights on deps.dev
Purl
pkg:npm/caen-caen-core

Affected ranges

Affected versions

35.*
35.5.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "2dcc4bdf2374089bf44b92c7766c7d6c7726644c9f623e50ce31f802fd71e102",
            "path": "_ext.js",
            "tlsh": "e6b1a79916a630198bb0dbe4c7175416f55be66337c182c5f79c95881f7312483b2efc"
        },
        {
            "sha256": "ac63fdd9c8fc2f8ab44aaf3f1a40d245c79dbcff12285b153cc7e69ab6accfac",
            "path": "lib/telemetry.js",
            "tlsh": "17835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-F1tN+e0A8rd0Wy54Nod7Z8Nq3nL7ppWA4xPkQrTCYhImJa3cQipwQZP9hUBC5f64yHNvsj8xVCpnEKEO3ZMkFA==",
                "sha1": "5f628ff5cf862de268c7788e9a35c86d0ea82a2c"
            },
            "filename": "caen-caen-core-35.5.8.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/caen-caen-core/MAL-2026-12520.json"