MAL-2026-12644

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-to-iso-string-with-timezone/MAL-2026-12644.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12644
Published
2026-08-05T14:01:45Z
Modified
2026-08-05T14:36:05.419698072Z
Summary
Malicious code in claims-to-iso-string-with-timezone (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa)

On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints (Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev with a DNS-TXT fallback to sdk.dl.wel1.ru) reconstructed from string-array joins, writes it to /tmp/.cache<rand> or %TEMP%\dotnetdiag<rnd>.exe, chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...). The package advertises itself as a date/timezone formatting utility with no declared dependencies; the dropper require is wrapped in a try/catch to swallow errors, and the dropped binary is named to impersonate dotnet diagnostic tooling. The package name resembles a legitimate date-formatting utility, and the harmful behavior is isolated in _init.js loaded by index.js.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa",
            "id": "IN-MAL-2026-015135",
            "modified_time": "2026-08-05T14:01:45Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:05.573973414Z",
            "versions": [
                "35.7.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-to-iso-string-with-timezone

Package

Name
claims-to-iso-string-with-timezone
View open source insights on deps.dev
Purl
pkg:npm/claims-to-iso-string-with-timezone

Affected ranges

Affected versions

35.*
35.7.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "5b7d25551f8a7a0f60b5f69c90ed13edca64490ed8474d6a097a3b062124baf6",
            "path": "_init.js",
            "tlsh": "f3a1965a16a6300c87b09bf487175415f55be66333c08288fb9c79981fb216483b2efc"
        },
        {
            "sha256": "15e66e39164c4ea9b50d54cbe48c5a82625d73ccac85569acfae29c7f3d18e42",
            "path": "package.json",
            "tlsh": "02d0a773453156770dfe42905ce2861b3b650f3f5175bd1ab6fb150814e527600ad331"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-/L0jDrofJunuUkl4mZ9qgjcVTSMVjf+1J/HCxuG6GmQukGUWEPrZOohmArYdFIc17gAXROUUiIn/nEkmd3UDPQ==",
                "sha1": "562a115a5e83339f54527e8cec5e4b9f9cfd2ede"
            },
            "filename": "claims-to-iso-string-with-timezone-35.7.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-to-iso-string-with-timezone/MAL-2026-12644.json"