MAL-2026-13027

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/book-collect/MAL-2026-13027.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13027
Published
2026-08-05T14:34:47Z
Modified
2026-08-05T15:51:49.319049371Z
Summary
Malicious code in book-collect (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (32d9f4b229afba5188036ffc4d7a5ac27d13339cd0f82920564cebbe13d089da)

On require('book-collect'), index.js loads loader.js which downloads a platform-specific binary from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT base64 fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are reconstructed at runtime via split-array.join("") and function names are built by concatenation ('child'+'process', 'chmod'+'Sync') to evade static analysis. The fetched bytes are written to /var/tmp/.cache<rand> or %TEMP%\dotnetdiag<rand>.exe (disguised as a dotnet diagnostic tool), chmod 0755, and spawned detached via '/bin/sh -c <path> &' or 'cmd.exe /c start /b'. No hash or signature verification is performed. A second copy of the same drop-write-chmod-exec chain lives in lib/telemetry.js under an 'Analytics SDK' cover story, with an env-var opt-out (DISABLETELEMETRY / ANALYTICSOPTOUT) that does not change the default install behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "32d9f4b229afba5188036ffc4d7a5ac27d13339cd0f82920564cebbe13d089da",
            "id": "IN-MAL-2026-015357",
            "modified_time": "2026-08-05T14:34:47Z",
            "import_time": "2026-08-05T15:19:46.868252392Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / book-collect

Package

Name
book-collect
View open source insights on deps.dev
Purl
pkg:npm/book-collect

Affected ranges

Affected versions

35.*
35.8.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "b27cd916fb383a0ea26cf9ed27da134a4b8660d76ef54bbe99dbd91af8cf61f1",
            "path": "_loader.js",
            "tlsh": "6ea1aa5a166a30184bb0dbe48717441af65be6633781c298fb5ca9d81f73124c3b2efc"
        },
        {
            "sha256": "bee43c6bd6061772d5c6705bee820c75b01e737c5b8ed787f450b39df4753ee1",
            "path": "lib/telemetry.js",
            "tlsh": "ed835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-SOk7VaguIDghLdMODnPurKiO9HqCcIin04iqVkhszhQ0O0gHSafAlamQ3GRF6GVUdvFY8FoLbhqVj/GlQYzGjg==",
                "sha1": "8cece4efb4b6a4c6f6efc676eb14a8b8fe2f4a10"
            },
            "filename": "book-collect-35.8.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/book-collect/MAL-2026-13027.json"