MAL-2026-13503

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/distributorblock/MAL-2026-13503.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13503
Published
2026-08-07T12:11:18Z
Modified
2026-08-07T12:35:11.234965610Z
Summary
Malicious code in distributorblock (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea)

The package's main entry (index.js) re-exports a decoy telemetry module and unconditionally require()s setup.js. On require, setup.js selects a platform-specific path, downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts under oob-worker.cf*.workers.dev (assembled via string concatenation to obscure the literal), writes it to /var/tmp/.cache<hex> on POSIX or %TEMP%\dotnetdiag<hex>.exe on Windows, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). A /tmp flag file rate-limits repeated runs and a DONOTTRACK check gates execution. When HTTP retrieval fails, setup.js reassembles the payload from base64-encoded chunks served over DNS TXT records at c.<domain> and 0..N.<domain> under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru — a covert channel that bypasses HTTP egress controls. The package's declared purpose ("API client wrappers") is inconsistent with fetching and executing a native binary at import time, and author metadata is empty. The naming (.cache, dotnetdiag), detached spawn, and DNS-TXT fallback are consistent with a trojan dropper designed to evade both sandboxing and network defenses.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:11:18Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016875",
            "import_time": "2026-08-07T12:23:25.349793508Z",
            "sha256": "f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / distributorblock

Package

Name
distributorblock
View open source insights on deps.dev
Purl
pkg:npm/distributorblock

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "distributorblock-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-83FzN570DlCiNnx/lKriqg97LuO3nj47Jva4Kh0qcKMQGRQL0CmmszPT0IPQUyvSopXUuAAgnurmMzeJqO1xbQ==",
                "sha1": "1926219998951aeef9be57b0b8989c6f77c803b8"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "56a1a75519fa70180792e5d4841b6816b19ef6933384e4d8fb8ca6884fd7628c3f3aec",
            "sha256": "bf9b4cd5823541f67d4bd394c33e53a802728ecc35a32b1f2152f1a66c6bebb8",
            "path": "setup.js"
        },
        {
            "tlsh": "0dc022a62ae42083014027dac863d0c322e2c2342280b1e44ad682bf4a8d8ca037ac00",
            "sha256": "096488fa68e6d1b2eefd3cb161117182f5651f8938c4290de624401358913fb3",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/distributorblock/MAL-2026-13503.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]