MAL-2026-4349

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clob.api/MAL-2026-4349.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4349
Published
2026-05-25T12:02:02Z
Modified
2026-05-26T06:02:23.191326192Z
Summary
Malicious code in clob.api (npm)
Details

A campaign of npm packages sharing a common dropper (clob.js) that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways (Pinata, Cloudflare, ipfs.io), drops it to %LOCALAPPDATA%, registers Windows Registry persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run using a hidden VBScript wrapper (window style 0, no taskbar entry), launches the payload immediately, and reports the victim's public IP address to a hardcoded C2 server via HTTP POST. macOS and Linux stubs are present but not yet configured. Developer artifacts bundled in config/meta_data.json leak the attacker's build path: E:\getting IP and check list\clob-downloader\.

clob.api bundles clob2.0.exe (≈4 MB) directly in the package tarball and also attempts to fetch an identical copy from IPFS at install time. Its postinstall script runs clob.js, which drops the executable to %LOCALAPPDATA%\clob2.0.exe. The C2 beacon transmits the victim's public IP to http://45.8.22.112:2026/api/urls.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2788e534ad4bce2154871c16cb6a6f35eed923f96bae6ca4bf041e197c30ed8a)

On install, package.json's postinstall hook runs node clob.js, which (1) downloads clob2.0.exe (Windows) or clob (macOS/Linux) from IPFS gateways including violet-tricky-quelea-562.mypinata.cloud, cloudflare-ipfs.com, ipfs.io, and gateway.pinata.cloud, falling back to a 4 MB clob2.0.exe PE binary bundled directly in the tarball; (2) writes the binary to %LOCALAPPDATA% / ~/.local/bin and launches it hidden via a generated VBS launcher invoked through wscript.exe //nologo with windowsHide:true; (3) installs autorun across all three operating systems — HKCU\Software\Microsoft\Windows\CurrentVersion\Run on Windows, ~/Library/LaunchAgents/com.clob.agent.plist with launchctl load on macOS, and ~/.config/autostart/clob.desktop on Linux; and (4) resolves the installer's public IP via api.ipify.org and POSTs it to a hardcoded bare-IP C2 endpoint at http://45.8.22.112:2026/api/urls?url=<public_ip>. The README is verbatim copied from @img/sharp-win32-x64 to impersonate the legitimate Sharp prebuilt, while package.json's own description ("Downloads clob2.0.exe on install") contradicts the README — this is deliberate camouflage. The bundled PE is undocumented and serves no advertised purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-05-25T12:02:02Z",
            "versions": [
                "2.73.0"
            ],
            "sha256": "2788e534ad4bce2154871c16cb6a6f35eed923f96bae6ca4bf041e197c30ed8a",
            "id": "IN-MAL-2026-004636",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:52:59.656640519Z"
        }
    ]
}
References
Credits

Affected packages

npm / clob.api

Package

Name
clob.api
View open source insights on deps.dev
Purl
pkg:npm/clob.api

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.73.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "954728b16738a4b44696a599eecde211ece2ccfcc9eb47bfaf4ba5c3ab6715be",
            "tlsh": "7412857a9af2612139b3d58dab0b441a6417b4073109ec54fa5cb35e6fcf02cc5a16fe",
            "path": "clob.js"
        },
        {
            "sha256": "c416cd0af88256407c36a0613f189ac4257221c7206d0324f7ef5563c66f1125",
            "tlsh": "fba1c0fe2c045a632ff1c9c67e0fad4fef19914c668e2d8874de9050632122969ec160",
            "path": "README.md"
        },
        {
            "sha256": "300a7dea05c2a588757010ad314fa55cb8ef3acebaa284f58a5cd0fd39bce478",
            "tlsh": "e9168d43f68592e9c0aec074c25b5237e376fc894a20679b73985b212f66b601f5f39c",
            "path": "clob2.0.exe"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-E5vmuKWiHwqaIbnznAsKen4WosxtUoVKhrNhsuEA+KaWxV66paqWuT03QA/TqN9X4M2jiglKIED/arxW4+mOhw==",
                "sha1": "7436f3b369b423a4b8bd3e7eca8903412d934b17"
            },
            "filename": "clob.api-2.73.0.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clob.api/MAL-2026-4349.json"