MAL-2026-12616

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-format-date/MAL-2026-12616.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12616
Published
2026-08-05T14:05:26Z
Modified
2026-08-05T14:35:50.933435805Z
Summary
Malicious code in claims-format-date (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd)

claims-format-date@35.6.5 auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT base64-chunk fallback through sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<uid>, dotnetdiag<uid>.exe), chmod 0755, and detached-spawned via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API references are reconstructed at runtime through array joins and string concatenation (require("child"+"process"), fs["chmod"+"Sync"]) to evade static analysis. A second parallel dropper implementation in lib/telemetry.js decodes a base64 buffer and performs the same write/chmod/exec chain under an 'analytics SDK' cover story. The package name resembles common date-formatting utilities but the shipped code implements remote payload execution on require.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd",
            "id": "IN-MAL-2026-015159",
            "modified_time": "2026-08-05T14:05:26Z",
            "import_time": "2026-08-05T14:20:08.083634659Z",
            "source": "amazon-inspector",
            "versions": [
                "35.6.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-format-date

Package

Name
claims-format-date
View open source insights on deps.dev
Purl
pkg:npm/claims-format-date

Affected ranges

Affected versions

35.*
35.6.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "0a2cb1b6e761a1c83eca2cbd80d366a25f770c4a2faa94842d2f45c6e15a0586",
            "path": "_init.js",
            "tlsh": "b1a177aa15a670094bb097e4c7275416f65be7633280c294fb5ca9885f7612483b2efc"
        },
        {
            "sha256": "9c5b5f3fcf1e13153bd1b91fa47a922e8bd6a84a914ca0bd4705265d92eb6398",
            "path": "lib/telemetry.js",
            "tlsh": "09835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-gsJAtNS0Y25ZRbpkS2EfzQ3P+vJZJGKnHk0Kc5DkUT4Zs/EJDVJU2bI5Kcc9HM4ZW3c/cTUPNhl5KBME4XbhXg==",
                "sha1": "9c468a303017ae2b41fb421ee941fd7acdc65d15"
            },
            "filename": "claims-format-date-35.6.5.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-format-date/MAL-2026-12616.json"