MAL-2026-12529

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cardsmobile-cardsmobile-core/MAL-2026-12529.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12529
Published
2026-08-05T14:17:02Z
Modified
2026-08-05T14:35:00.557053985Z
Summary
Malicious code in cardsmobile-cardsmobile-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30)

On require() of cardsmobile-cardsmobile-core, index.js loads shim.js which selects a platform-specific payload path, fetches an unsigned executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes it to a hidden path under /var/tmp or %TEMP% with decoy names (dotnetdiag_*.exe,.cache_*), chmods 0755, and spawns it detached via /bin/sh or cmd.exe. A cooldown lockfile at /tmp/.analyticsstate prevents re-runs. Endpoint hostnames and dangerous API names are assembled at runtime via.join('') from string fragments (e.g. require("child" + "process"), fs["chmod" + "Sync"]) to evade static analysis, and lib/telemetry.js additionally decodes a base64 payload before executing it. A DISABLE_TELEMETRY environment check is present but does not gate the dropper. Loading this package grants remote code execution on the installer's host with detached persistence beyond the Node process.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30",
            "id": "IN-MAL-2026-015239",
            "modified_time": "2026-08-05T14:17:02Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:15.699993298Z",
            "versions": [
                "35.6.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cardsmobile-cardsmobile-core

Package

Name
cardsmobile-cardsmobile-core
View open source insights on deps.dev
Purl
pkg:npm/cardsmobile-cardsmobile-core

Affected ranges

Affected versions

35.*
35.6.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "e97ae393df8939b956a790e217e37097cff06489bda0b0c81f20618a5d22c4af",
            "path": "_shim.js",
            "tlsh": "dfa1869a15a6701c4bb0a7e0ca1b8825f55ff663378082d4fb9c65895f7352483b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-N89DXce+/v2rdIq0OpmqHyZFHq4jNcFaYRUeq73xxZADGETV3sW/rUX5+CxibWY4xbWLEKSObaVewTY8ejQ2RQ==",
                "sha1": "ab91fcef76f6f97ff80eece4e3e453bc342f4521"
            },
            "filename": "cardsmobile-cardsmobile-core-35.6.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cardsmobile-cardsmobile-core/MAL-2026-12529.json"