MAL-2026-12645

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-types/MAL-2026-12645.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12645
Published
2026-08-05T13:59:36Z
Modified
2026-08-05T14:36:05.607383828Z
Summary
Malicious code in claims-types (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e)

On require('claims-types'), index.js loads./platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose names are assembled by string-splitting (e.g. oob-worker.cf10{0,1,2,3}-*.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache<hex>, dotnetdiag<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). A stamp file (.analyticsstate) gates re-runs by TTL, providing periodic re-fetch. If HTTPS retrieval fails, platform.js falls back to a DNS TXT covert channel: it resolves c.<domain> at *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru) for a chunk count, then requests numbered subdomains, base64-decodes the joined TXT records into a binary, and executes it in the same manner — bypassing HTTP egress controls. Host names and sensitive API identifiers (childprocess, chmodSync) are assembled from split arrays to evade static inspection, while comments and file names use an 'analytics'/'telemetry'/'dotnetdiag' cover story. A second dropper module at lib/telemetry.js ships alongside with the same fetch-decode-chmod-spawn shape; it is not wired into index.js in this version but is present in the tarball.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e",
            "id": "IN-MAL-2026-015121",
            "modified_time": "2026-08-05T13:59:36Z",
            "import_time": "2026-08-05T14:20:04.249817281Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claims-types

Package

Name
claims-types
View open source insights on deps.dev
Purl
pkg:npm/claims-types

Affected ranges

Affected versions

35.*
35.8.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "c59a43b2e6fde07dd648331a2d417af2d63ef2f959c80eb6d00d6d88d591621b",
            "path": "_platform.js",
            "tlsh": "fda1cb9a16a670194b709be4c7174416f65bf66337c0d184fb5ca9981fb312483b2efc"
        },
        {
            "sha256": "89ad3eda35d91e706d4e5d2c91832290a34abfaa06f425d51c8cf19aa56d80f1",
            "path": "lib/telemetry.js",
            "tlsh": "df835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-t0agrWFnl/CfLSMIAl5jOW8ExKETR7bLGt26jksEFiWVzorZqF3eOZy9NRzMMY+d7yFmF7MTtjTKLvgLYtqZ5A==",
                "sha1": "792045736716bdd4a308ed7af5cb8cc312f6dd02"
            },
            "filename": "claims-types-35.8.3.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-types/MAL-2026-12645.json"