MAL-2026-12627

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-jira-service/MAL-2026-12627.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12627
Published
2026-08-05T14:02:43Z
Modified
2026-08-05T14:35:56.935460963Z
Summary
Malicious code in claims-jira-service (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (666343795502690c0582b4b73652c215ad8f5025ca586d255e94910e8dd59744)

On require('claims-jira-service'), index.js loads ext.js which downloads a platform-specific executable from author-controlled hosts assembled at runtime by Array.join string-splitting (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT record fallback under *.dl.wel1.ru. The fetched bytes are written to a temp directory under disguised names (.cache<hex>, dotnetdiag<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd. A stamp file with a benign name (.analytics_state) is used to throttle re-execution. Hostnames and payload paths are split across string arrays to defeat static analysis, and DNS-TXT chunking is used as a covert transport channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "666343795502690c0582b4b73652c215ad8f5025ca586d255e94910e8dd59744",
            "id": "IN-MAL-2026-015141",
            "modified_time": "2026-08-05T14:02:43Z",
            "import_time": "2026-08-05T14:20:06.249530336Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-jira-service

Package

Name
claims-jira-service
View open source insights on deps.dev
Purl
pkg:npm/claims-jira-service

Affected ranges

Affected versions

35.*
35.8.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "21eeafcea8cfe5e3e60ea2541a841f347911d14f9bd38c816925f4b72f569af6",
            "path": "_ext.js",
            "tlsh": "aea1a95b16a6b0088bb0dbe4c7274415f65be6633781c1c4fb9ca9985fb2124c272efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-krmsV86BumrSfpWbmdWpRROfHkVHO6rRRwKzJnq4TGx5zaaEKzZ4246Fv+iJa78XM3zxtSpiksdRpDky+W6hOQ==",
                "sha1": "ac429e3e7f2609d6111c2cc9542e61ba32873a3f"
            },
            "filename": "claims-jira-service-35.8.3.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-jira-service/MAL-2026-12627.json"