MAL-2026-13281

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/docsmate-docsmate-core/MAL-2026-13281.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13281
Published
2026-08-05T15:29:07Z
Modified
2026-08-05T16:50:31.861327242Z
Summary
Malicious code in docsmate-docsmate-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e)

On require(), index.js loads support.js which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf, cf102-baf) from split string fragments, with a DNS-TXT fallback resolver chain across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. It downloads an OS/arch-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmods 0755, and detaches it via spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or spawn('cmd',...). A stamp file suppresses re-runs and environment variables can disable execution. The package presents itself as a platform/core types library and ships no shipped native source that would justify fetching and executing an opaque binary at import time. Destination hosts are string-obfuscated to evade static inspection, and the dropped file is named to impersonate a Microsoft.NET diagnostic tool.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.9.3"
            ],
            "id": "IN-MAL-2026-015716",
            "import_time": "2026-08-05T16:13:35.530544701Z",
            "modified_time": "2026-08-05T15:29:07Z",
            "source": "amazon-inspector",
            "sha256": "9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e"
        }
    ]
}
References
Credits

Affected packages

npm / docsmate-docsmate-core

Package

Name
docsmate-docsmate-core
View open source insights on deps.dev
Purl
pkg:npm/docsmate-docsmate-core

Affected ranges

Affected versions

35.*
35.9.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-zbDUxWJfGHYoYJtjfGrxUtCGiE2AN2HjX1oSCesdHFdEdoZTFyi4Y0vjUDGSsj7ch0om/0BZaKiDlwC9BtqFkg==",
                "sha1": "bbdfe1d9920eb283384ebf25518e9c7d2441c4c2"
            },
            "filename": "docsmate-docsmate-core-35.9.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "tlsh": "31a1975b156a70188b709bf0c7174816f65bf6633380c584fb9ca9985f7252483b2efc",
            "sha256": "40c79432762782f32d31c3a7c1cdc71370eeea0d06630e40427cf8c1e9b79532"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/docsmate-docsmate-core/MAL-2026-13281.json"