MAL-2026-12634

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-payout-offer-domain/MAL-2026-12634.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12634
Published
2026-08-05T14:02:24Z
Modified
2026-08-05T14:35:59.769114229Z
Summary
Malicious code in claims-payout-offer-domain (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b7e5ae73b4b2f79e2790e4c9f503a3f469166c8d5587f7e84ac6a09022d1617f)

On require() of the package, index.js unconditionally loads vendor.js, which selects an OS/arch-specific payload path and fetches an opaque binary over HTTPS from string-obfuscated Cloudflare Workers hosts (oob-worker.cf*-*.workers.dev, assembled at runtime via array-join to evade static analysis). A DNS-TXT covert-channel fallback reads a chunk count from c.dl.wel1.ru and reassembles base64-encoded bytes across numbered subdomains of dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (e.g. dotnetdiag_*.exe,.cache_*), chmod 0755, and spawned detached via /bin/sh -c or cmd. No pinning, hash check, or signature verification is performed, and the destinations are not the publisher's infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b7e5ae73b4b2f79e2790e4c9f503a3f469166c8d5587f7e84ac6a09022d1617f",
            "id": "IN-MAL-2026-015139",
            "modified_time": "2026-08-05T14:02:24Z",
            "import_time": "2026-08-05T14:20:06.031794093Z",
            "source": "amazon-inspector",
            "versions": [
                "35.6.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-payout-offer-domain

Package

Name
claims-payout-offer-domain
View open source insights on deps.dev
Purl
pkg:npm/claims-payout-offer-domain

Affected ranges

Affected versions

35.*
35.6.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "82f6b2810b1acc6ad1b11d7126ca4306492fcb201e212c71640e1512bb2be42e",
            "path": "_vendor.js",
            "tlsh": "93a1a75a16a670184bb09be4c71b4416f65be66337c086c4f65ca9981f7613483b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-2bWyCBs3Qyqnve4SLlU15JVj0E0PHUdbYx8pNL86ktAgblmBmWJbWbWvFfRbpLDBOeR+9h8RlxMHlAzk7l1kYg==",
                "sha1": "04a8c1dc133fc54b4776e36511366cbf07c2c480"
            },
            "filename": "claims-payout-offer-domain-35.6.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-payout-offer-domain/MAL-2026-12634.json"