MAL-2026-12637

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-policies-api-adapters/MAL-2026-12637.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12637
Published
2026-08-05T14:01:27Z
Modified
2026-08-05T14:36:01Z
Summary
Malicious code in claims-policies-api-adapters (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5d8ba02b55d458bc61e8bda89796763be5f0318df30b36dca5746990b9a578db)

On require() of claims-policies-api-adapters, index.js loads vendor.js which reconstructs hostnames from split string fragments joined via.join(''), fetches a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with DNS TXT records under *.dl.wel1.ru as a covert fallback channel that base64-assembles the payload. The binary is written to a temp path under a disguised name, chmod'd to 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', path + ' &'], {detached:true}) on Unix or cmd.exe start /b on Windows. No hash or signature verification is performed and the destinations are not publisher-owned infrastructure. An opt-out env-var gate and a '.analytics_state' freshness marker suppress re-execution. A second module lib/telemetry.js ships the same dropper shape with dynamically-constructed require('child'+'process') and fs['chmod'+'Sync'] to evade static inspection. The package is advertised as a REST client adapter; the dropper behavior is unrelated to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015133",
            "import_time": "2026-08-05T14:20:05.405195753Z",
            "modified_time": "2026-08-05T14:01:27Z",
            "sha256": "5d8ba02b55d458bc61e8bda89796763be5f0318df30b36dca5746990b9a578db",
            "source": "amazon-inspector",
            "versions": [
                "35.6.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-policies-api-adapters

Package

Name
claims-policies-api-adapters
View open source insights on deps.dev
Purl
pkg:npm/claims-policies-api-adapters

Affected ranges

Affected versions

35.*
35.6.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "acbe2d2655000be6f0a6ed9c52b905768cdd88eaf7cd8074d7ba82862b060d96",
            "tlsh": "34b1866a156a70188bb0dbe5c7175416f657f663738082c4fb9c69981fb312482f2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "11db5544fd74f025c17d78d04cc6d66fc57435f5c887b2fff3decfedf1bd51d2",
            "tlsh": "4e835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "filename": "claims-policies-api-adapters-35.6.7.tgz",
            "hashes": {
                "sha1": "3453fdff0826c091ba5049cced0bffcb1c5facbe",
                "sha512_sri": "sha512-i2r2mfYeVhv2hr1++lUGP/v4BrX1wO5fnIQMvetxAoetHfo4GjRZiv8awTi7BGcAnuCu3vRO923GINQrnb+Pog=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-policies-api-adapters/MAL-2026-12637.json"