MAL-2026-12670

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dc-dc-core/MAL-2026-12670.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12670
Published
2026-08-05T13:58:09Z
Modified
2026-08-05T14:36:18.590864213Z
Summary
Malicious code in dc-dc-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e706ce5be3f3c1cf779ad16844cea8737714c708fe739316bec4ff400b415139)

On require('dc-dc-core'), index.js loads support.js which fetches a platform-specific native binary from obfuscated Cloudflare worker hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temp path under a disguised name (dotnetdiag_*.exe on Windows,.cache_* on Unix), chmods 0755, and spawns it detached via childprocess.spawn (spawn('/bin/sh',...) or spawn('cmd',...)). A DNS-TXT fallback channel reassembles a payload by querying resolver domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. Hostnames are constructed by joining split string fragments at runtime to evade static detection, and the module wraps the behavior in analytics/telemetry cover-story naming (DISABLETELEMETRY env gate, /tmp/.analytics_state TTL flag). The package name resembles legitimate scopes but ships an import-time dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T14:20:03.270299374Z",
            "modified_time": "2026-08-05T13:58:09Z",
            "id": "IN-MAL-2026-015112",
            "sha256": "e706ce5be3f3c1cf779ad16844cea8737714c708fe739316bec4ff400b415139",
            "versions": [
                "35.3.3"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dc-dc-core

Package

Name
dc-dc-core
View open source insights on deps.dev
Purl
pkg:npm/dc-dc-core

Affected ranges

Affected versions

35.*
35.3.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dc-dc-core/MAL-2026-12670.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-NJDbTZeCc5LQZkGZ2Rmf8fKUoSOy95Jyzr5jvKl5E5wn9MqOmY4u01dW8vw2Ru+V/+w+bg0k8QH8/GxJL+ZlPQ==",
                "sha1": "9600d7e111a9703c67345c912bc13f9f4d8fbd5b"
            },
            "filename": "dc-dc-core-35.3.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "tlsh": "3ba1876a15aa70298b70dbe5c7274416f65bfa533381c288fb5c95984f72124c3b2efc",
            "sha256": "660cc5a3613ef614b424db19deba7d24305797e6f3a250ed1f6875fab85aca5a"
        }
    ]
}