MAL-2026-12624

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-historical-claims-api-adapters/MAL-2026-12624.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12624
Published
2026-08-05T14:03:58Z
Modified
2026-08-05T14:35:55.345436544Z
Summary
Malicious code in claims-historical-claims-api-adapters (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997)

index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments (e.g. ["oob-worker.cf99-9b","3.wo","rk","ers.d","ev"].join("")) to yield oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Based on process.platform, a binary is downloaded over HTTPS, written to /var/tmp or %TEMP% under a disguised name (.cache<rand> or dotnetdiag<rand>.exe), chmod'd 0755, and spawned detached via cp.spawn("/bin/sh",["-c", fp+" &"],{detached:true,stdio:"ignore"}).unref(). A parallel dropper module lib/telemetry.js, framed as an 'Analytics SDK', ships the same fetch-write-exec shape with require("child"+"process") and fs["chmod"+"Sync"] dynamic property assembly. The obfuscation of host strings and module names, disguised filenames, and detached background execution are consistent with a canonical import-time RCE dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997",
            "id": "IN-MAL-2026-015149",
            "modified_time": "2026-08-05T14:03:58Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:07.192600345Z",
            "versions": [
                "35.7.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-historical-claims-api-adapters

Package

Name
claims-historical-claims-api-adapters
View open source insights on deps.dev
Purl
pkg:npm/claims-historical-claims-api-adapters

Affected ranges

Affected versions

35.*
35.7.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "35bcdc930c71999afbadd586a6e7e0c62998ae87b2809865eaf76e5fdea611a4",
            "path": "_loader.js",
            "tlsh": "bca1b76a12a670198bb0d7e487175416f65bf6733781c2c8fb5ca5841f7212483b2efc"
        },
        {
            "sha256": "374259cc2ad1a75155c308097327f3b2f01312293d5b577a000ea4f8576fedfb",
            "path": "lib/telemetry.js",
            "tlsh": "d8835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-MvUVEU/Rkf/Ekwuo3qv43R+YmLKEZ1hVpG/7axER6+5BlDTpfdjb+P7CLvbNtukBDoZHdcG1fw5DlAy9rqu/lw==",
                "sha1": "b73a4fc0854b6643cfe39e4a8a93bc3e809c3c28"
            },
            "filename": "claims-historical-claims-api-adapters-35.7.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-historical-claims-api-adapters/MAL-2026-12624.json"