MAL-2026-4468

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@wengine-ai/claude-code-router-shared/MAL-2026-4468.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4468
Withdrawn
2026-05-26T18:45:39Z
Published
2026-05-20T02:15:54Z
Modified
2026-05-27T00:32:04Z
Summary
Malicious code in @wengine-ai/claude-code-router-shared (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (45e362000d036139e02a066a82ec157314a07796e0e855cdce184cc081ca4591)

dist/index.js line 14 issues a fetch() call to https://pub-0dc3e1677e894f07bbea11b17a29e032.r2.dev, an anonymous Cloudflare R2 bucket, and references process.platform and process.versions to select a platform-specific payload. Anonymous .r2.dev buckets are mutable, attacker-controlled storage with no publisher accountability and no version pinning — the bytes served at the URL can be swapped at any time without any change to the published package. The R2-bucket pattern matches confirmed payload-distribution infrastructure used in prior npm-cluster compromises where lifecycle/import-time fetches from pub-.r2.dev hosts dropped platform-native binaries onto installer machines. Combined with platform-fingerprinting (process.platform, process.versions), this is the canonical fetch-and-execute dropper shape: select binary by OS/arch, retrieve from anonymous mutable host, execute. Installing or loading this package exposes the installer to arbitrary attacker-controlled code execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003402",
            "import_time": "2026-05-26T05:50:34.629225612Z",
            "modified_time": "2026-05-20T02:17:54Z",
            "sha256": "3c19f8a7681f8c3cfc253a92fdd5df997504932a94d5808a16d02d3ff1d022d3",
            "source": "amazon-inspector",
            "versions": [
                "2.0.24"
            ]
        },
        {
            "id": "IN-MAL-2026-003403",
            "import_time": "2026-05-26T05:50:34.72318225Z",
            "modified_time": "2026-05-20T02:20:14Z",
            "sha256": "45e362000d036139e02a066a82ec157314a07796e0e855cdce184cc081ca4591",
            "source": "amazon-inspector",
            "versions": [
                "2.0.41"
            ]
        },
        {
            "id": "IN-MAL-2026-003401",
            "import_time": "2026-05-26T05:50:34.490558762Z",
            "modified_time": "2026-05-20T02:15:54Z",
            "sha256": "6795396e80ff11de703186fa1afb45b55e5d4013de5decf47fa3f0a7b861c64b",
            "source": "amazon-inspector",
            "versions": [
                "2.0.25"
            ]
        },
        {
            "id": "IN-MAL-2026-003424",
            "import_time": "2026-05-26T05:50:37.014628179Z",
            "modified_time": "2026-05-20T02:33:53Z",
            "sha256": "83e09240cee3dad2cdbe9b369b7538bf4fcaa2a7ba1a75ceab62cc0498e56b93",
            "source": "amazon-inspector",
            "versions": [
                "2.0.21"
            ]
        },
        {
            "id": "IN-MAL-2026-003427",
            "import_time": "2026-05-26T05:50:37.331179668Z",
            "modified_time": "2026-05-20T02:38:21Z",
            "sha256": "99790274d8c8ab9d1c9cb910ed30aaaaa266d0a594ed6959bef7c54435022830",
            "source": "amazon-inspector",
            "versions": [
                "2.0.22"
            ]
        },
        {
            "id": "IN-MAL-2026-003440",
            "import_time": "2026-05-26T05:50:38.832281695Z",
            "modified_time": "2026-05-20T02:53:17Z",
            "sha256": "a9a232664d2c2a2e8c32a4a35cb44fcde412f96991e62713bafab7ca9b1c8f24",
            "source": "amazon-inspector",
            "versions": [
                "2.0.26"
            ]
        },
        {
            "id": "IN-MAL-2026-003417",
            "import_time": "2026-05-26T05:50:36.284931393Z",
            "modified_time": "2026-05-20T02:28:46Z",
            "sha256": "eaaf2212ec0c3bb15d6ab48d8c0e71a055db79e8202b220ebd8b77d50cc6a4c8",
            "source": "amazon-inspector",
            "versions": [
                "2.0.23"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wengine-ai/claude-code-router-shared

Package

Name
@wengine-ai/claude-code-router-shared
View open source insights on deps.dev
Purl
pkg:npm/%40wengine-ai%2Fclaude-code-router-shared

Affected ranges

Affected versions

2.*
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.41

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "d52d7da77b74b536ed4ca54ebc53c4fbecf527764793dccb828513a52a667f3e",
            "tlsh": "6173298a32d6f23183a5701acc7a460ef1f859c8840cd825ebbde5e3716950991f3bf8"
        }
    ],
    "package_integrity": [
        {
            "filename": "claude-code-router-shared-2.0.24.tgz",
            "hashes": {
                "sha1": "595b958f529bf3e422d4766933b5d631aead7e98",
                "sha512_sri": "sha512-RJODdSBCnVx4jCBhVHueCkjaBRQHPDqZI8bZ0qfyQ6TL9lEihO0ADHHvy02rflVIF794zR1l7YOUx5eP6E7vZw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@wengine-ai/claude-code-router-shared/MAL-2026-4468.json"