MAL-2026-12526

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cards-forms-clone-debit-clone/MAL-2026-12526.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12526
Published
2026-08-05T14:19:21Z
Modified
2026-08-05T14:34:57.476088333Z
Summary
Malicious code in cards-forms-clone-debit-clone (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4)

On require(), index.js loads bootstrap.js which reconstructs endpoint hostnames from split string fragments (assembling *.workers.dev hosts such as oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf, with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary, writes it under a decoy filename ('dotnetdiag<hex>.exe' on Windows, '.cache<hex>' on POSIX) into /tmp or %TEMP%, chmods it 0755, and detach-spawns it via '/bin/sh -c <path> &' or 'cmd.exe /c start /b'. No hash or signature verification is performed and the fetch URLs are unpinned. Telemetry-style cover strings ('.analyticsstate', DISABLETELEMETRY / DONOTTRACK env-var gating) and host-string reassembly conceal the C2 destinations and the nature of the dropped executable.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015255",
            "import_time": "2026-08-05T14:20:17.087040239Z",
            "sha256": "af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4",
            "modified_time": "2026-08-05T14:19:21Z",
            "versions": [
                "35.8.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / cards-forms-clone-debit-clone

Package

Name
cards-forms-clone-debit-clone
View open source insights on deps.dev
Purl
pkg:npm/cards-forms-clone-debit-clone

Affected ranges

Affected versions

35.*
35.8.6

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1qb5uEHkEFswMSYAqidGurOJvRHWyAYoy3LIfUmzJpjjY5mJBIUgU6NxMdg3g57h6Ega6cQ5UmZ1imXFnPIXxQ==",
                "sha1": "ea0edc680bbcbf6c88f16600147e8940c6453cdf"
            },
            "filename": "cards-forms-clone-debit-clone-35.8.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "215eff626673525cc15948d7b45c7003e23b37ac41cb899516ddddf0dfbcb0d8",
            "path": "_bootstrap.js",
            "tlsh": "5da1969a16a6700d8bb0d7e4c7175816f65be6633781c294fb5ca5881f7212483b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cards-forms-clone-debit-clone/MAL-2026-12526.json"