MAL-2026-12538

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/certificates-revocation-sw/MAL-2026-12538.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12538
Published
2026-08-05T14:17:30Z
Modified
2026-08-05T14:35:07.075887281Z
Summary
Malicious code in certificates-revocation-sw (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a)

The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev and similar, assembled by joining split string fragments) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache<hex> on POSIX, dotnetdiag<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. The package advertises itself as a certificate-revocation provider but contains no such functionality; the dropper is gated by cover-story env vars (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOT_TRACK) and mislabeled with 'telemetry'/'analytics' comments. Hostname obfuscation, disguised drop paths, detached execution, and the mismatch between advertised purpose and actual behavior indicate a deliberate remote-code-execution dropper against the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a",
            "id": "IN-MAL-2026-015242",
            "modified_time": "2026-08-05T14:17:30Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:15.953992679Z",
            "versions": [
                "35.6.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / certificates-revocation-sw

Package

Name
certificates-revocation-sw
View open source insights on deps.dev
Purl
pkg:npm/certificates-revocation-sw

Affected ranges

Affected versions

35.*
35.6.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "6f283b7bcd0d966ae929d9be0965a11b6981c1946e0bad76083c99730379928d",
            "path": "_bootstrap.js",
            "tlsh": "2db17496166970294bb0d7f4871b4416f65af6a33380c284fb5ca9981f73124c2b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-JB+d2zlRa9nMe2fTQpPXfpHYUAjmBnZiWXUPWPJBaIuU3lfMsD4BabshAY3rWEVotSWjVM7dfCSAqzZxq7PQ/w==",
                "sha1": "1f07aaa14732da8fcfe61ac1e6994b1faa174da8"
            },
            "filename": "certificates-revocation-sw-35.6.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/certificates-revocation-sw/MAL-2026-12538.json"