MAL-2026-12614

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-enums/MAL-2026-12614.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12614
Published
2026-08-05T14:04:23Z
Modified
2026-08-05T14:35:49.929474088Z
Summary
Malicious code in claims-enums (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e)

On require('claims-enums'), index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS-TXT chunked fallbacks resolved from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to /tmp or %TEMP% under cover-story filenames (e.g. dotnetdiag<hex>.exe,.cache<hex>), chmod'd 0755, and detach-spawned via /bin/sh or cmd.exe. Hostnames, the childprocess import, and fs.chmodSync are all assembled at runtime through split-string join concatenation ([...].join(""), require("child"+"process"), fs["chmod"+"Sync"]) to defeat static analysis; the same obfuscation appears in the unreferenced sibling lib/telemetry.js. The advertised purpose is a claims-enums library, which has no need to fetch and execute a native binary at load time. A DISABLE_TELEMETRY environment check is present as cover framing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e",
            "id": "IN-MAL-2026-015152",
            "modified_time": "2026-08-05T14:04:23Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:07.4705247Z",
            "versions": [
                "35.7.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-enums

Package

Name
claims-enums
View open source insights on deps.dev
Purl
pkg:npm/claims-enums

Affected ranges

Affected versions

35.*
35.7.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "159c30a8cd98e7758f792b065d36dce94a78b08b178236c64b73ee9d7c83f578",
            "path": "_polyfill.js",
            "tlsh": "80a1b99a02a570188f70ebe4c7179826f65af66337808284fb9c65945fb3654c3b2dfc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-e4YVNzkW3FnS2cOCK9LetMU1sUtWuQyt2xqpm83jA2JtitNVaNa2NPMJvdJBMiOTGgailqW7QHXe2yrrZnXJ+w==",
                "sha1": "d14cf3e45f40bd3ae45556cdcd2b5bfc75b13673"
            },
            "filename": "claims-enums-35.7.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-enums/MAL-2026-12614.json"