MAL-2026-12660

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/constructor-blocks-common/MAL-2026-12660.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12660
Published
2026-08-05T13:57:42Z
Modified
2026-08-05T14:36:12.328189948Z
Summary
Malicious code in constructor-blocks-common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31)

On require() of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs destination hostnames via Array.join string-splitting (e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf101-adf.workers.dev', 'oob-worker.cf99-9b3.workers.dev') plus a DNS-TXT fallback channel under *.dl.wel1.ru (linuxx64 host assembled from ['sd','k.d','l.wel1.','ru']), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a disguised filename (.cache<hex> or dotnetdiag_<hex>.exe), chmods 0755, and detaches it via spawn('/bin/sh', ['-c', filePath+' &']) or spawn('cmd',...). The fetched bytes are opaque, unpinned, and unrelated to the package's stated purpose of 'cross-module shared code'. A second copy of the dropper is bundled at lib/telemetry.js under an 'Analytics SDK' cover story (base64 chunk assembly, cp.spawn('/bin/sh',...), fs['chmod'+'Sync'] concatenated to evade static analysis). Cover-story comments ('Detached process to avoid blocking npm install', 'Clean up temporary files') accompany the exec paths. Installing or requiring this package results in remote code execution on the installer host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015109",
            "import_time": "2026-08-05T14:20:02.963528895Z",
            "sha256": "96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31",
            "modified_time": "2026-08-05T13:57:42Z",
            "versions": [
                "35.5.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / constructor-blocks-common

Package

Name
constructor-blocks-common
View open source insights on deps.dev
Purl
pkg:npm/constructor-blocks-common

Affected ranges

Affected versions

35.*
35.5.6

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-VbPRi7Pu9OGw7xG8473eMen1PzGsDQ8I6hn4UL2y5LFpMEr/P+WEVpEh5CD+XgBzgBqPaXHvNxZHxFkxK3Qi3A==",
                "sha1": "f43a7d4c0a2a1b6aff2a337eeec81822490ac088"
            },
            "filename": "constructor-blocks-common-35.5.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "sha256": "04c749dfc05936d82f9cb0705f9597fe347a016b7b8e4162f19e5587edca7a01",
            "tlsh": "0ca1869b16aa701c4bb09bf4871b4416f65bf6633780c185fb5ca9981f7212482b2efc"
        },
        {
            "sha256": "b5afa37279e8672357a80833eb96e02b5f010674b8dbed96eb2c35dfcb3e787b",
            "path": "lib/telemetry.js",
            "tlsh": "ee835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/constructor-blocks-common/MAL-2026-12660.json"