MAL-2026-12539

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/certificates-revocation-utils/MAL-2026-12539.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12539
Published
2026-08-05T14:17:12Z
Modified
2026-08-05T14:35:07.347854065Z
Summary
Malicious code in certificates-revocation-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837)

On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames (assembled via split-string concatenation such as ['oob-worker.','cf101-','adf.workers.','de','v'].join('')) with a DNS-TXT base64 chunked fallback resolved via *.dl.wel1.ru. The fetched bytes are written to a temp path with a randomized name, chmod 0755'd on POSIX, and executed via detached cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}) or cp.spawn('cmd.exe',['/c','start','/b',fp]). The download URL is not pinned, not hash-verified, and unrelated to the package's stated purpose ("shared utilities"). Additional obfuscation hides the childprocess require and chmodSync call (require('child_'+'process'), fs['chmod'+'Sync']), and a /tmp/.analytics_state stamp gates single-execution-per-TTL. Requiring or installing this package causes arbitrary attacker-controlled code to execute on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837",
            "source": "amazon-inspector",
            "versions": [
                "35.1.9"
            ],
            "modified_time": "2026-08-05T14:17:12Z",
            "id": "IN-MAL-2026-015240",
            "import_time": "2026-08-05T14:20:15.790323807Z"
        }
    ]
}
References
Credits

Affected packages

npm / certificates-revocation-utils

Package

Name
certificates-revocation-utils
View open source insights on deps.dev
Purl
pkg:npm/certificates-revocation-utils

Affected ranges

Affected versions

35.*
35.1.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/certificates-revocation-utils/MAL-2026-12539.json"
indicators 
{
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "bfa1d033c4f346d215519cf17832e4c9a0ded9ba90ddafbaee12b7939909a2a2",
            "tlsh": "25b1b79a16aa70194bb0dbe08b174416f65bf6633780c2d4fb9ca5985fb31248371efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "76737fa8ad944ccf1e6c24369080a7591fd72823",
                "sha512_sri": "sha512-mbhAxqhqadhDgOG9sgHhMWtk3Y/4u4Fy4Cak/u/h6399KUo5ksTBKva3758Xet8K3fFNWlRh0MP3uqzDXx7Gng=="
            },
            "filename": "certificates-revocation-utils-35.1.9.tgz"
        }
    ]
}