MAL-2026-12536

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cardsmobile-storage/MAL-2026-12536.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12536
Published
2026-08-05T14:16:38Z
Modified
2026-08-05T14:35:05.847590919Z
Summary
Malicious code in cardsmobile-storage (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b)

On require(), index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded binary is written to /tmp or %TEMP% under a disguised name (.cache<hex> on POSIX, dotnetdiag<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the file is spawned detached and unref'd via /bin/sh -c or cmd.exe/start. Host names and the childprocess module name are assembled at runtime from split-string arrays (require("child" + "process"), ["oob-worke","r.cf99-9b3",".wor","kers.d","ev"].join("")) to evade static URL/module scanners. A parallel dropper implementation with the same primitives (HTTPS with endpoint rotation, DNS-TXT base64 service discovery, fs.chmodSync 0o755, cp.spawn("/bin/sh", ["-c", filePath + " &"])) is bundled in lib/telemetry.js (81 KB, labeled as an "Analytics SDK") and shipped in the tarball as an alternate execution path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b",
            "id": "IN-MAL-2026-015236",
            "modified_time": "2026-08-05T14:16:38Z",
            "import_time": "2026-08-05T14:20:15.460825448Z",
            "source": "amazon-inspector",
            "versions": [
                "35.6.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cardsmobile-storage

Package

Name
cardsmobile-storage
View open source insights on deps.dev
Purl
pkg:npm/cardsmobile-storage

Affected ranges

Affected versions

35.*
35.6.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "bb1f7255969130ade3854c1b4ed128e87310f3f3a52da6653bbdeb40162ab2ca",
            "path": "_shim.js",
            "tlsh": "49a1b75a06a6701c4b70a7e0c71b882af55bf2633781c2d4fbac55945f7252483b2efc"
        },
        {
            "sha256": "f14609817d27c3b6672f1d5d7d300550347dd36a6847afa6127e61308e34e788",
            "path": "lib/telemetry.js",
            "tlsh": "e9835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-EsecZ45s8mEcJ1LFgIkmVvyVw0jnwIWXGSlgeQBMECUPYDEfwU4TRawLlDtrgEavtTarPExOrvyH3PoGTM21Tw==",
                "sha1": "80d74d135f0549c5358d096c41f60eff590bd43f"
            },
            "filename": "cardsmobile-storage-35.6.5.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cardsmobile-storage/MAL-2026-12536.json"