MAL-2026-6576

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkmarx-claude-cache/MAL-2026-6576.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-6576

Published

2026-06-29T05:59:14Z

Modified

2026-07-09T17:31:58.323028538Z

Summary

Malicious code in checkmarx-claude-cache (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9)

When the CLI runs (the documented npx checkmarx-claude-cache invocation pattern), bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike host — https://download.east-1.us.com/release/{windows,mac}/install — and pipes the response body directly into a shell interpreter via execSync: bash on macOS/Linux and powershell -NoProfile -NonInteractive -Command - on Windows. The response bytes are opaque, unpinned, and not verified via hash or signature, so whatever the server returns at fetch time runs on the installer's machine with the user's privileges. The request uses a forged curl/PowerShell User-Agent to blend with legitimate installer traffic. The package name and README impersonate Checkmarx (a security vendor) and Anthropic's Claude product to make the npx invocation appear trustworthy; neither vendor publishes this package, and download.east-1.us.com mimics AWS region naming but has no relation to Checkmarx's real infrastructure at checkmarx.com. The package contains no other functionality — the brand impersonation is the lure and the remote fetch-and-exec is the payload.

Database specific

{
    "malicious-packages-origins": [
        {
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "import_time": "2026-06-29T07:09:10.742684817Z",
            "id": "IN-MAL-2026-007761",
            "sha256": "4cbdcac8329a6ad9662ef7af8e0f68cd616f5451dc0a1fce9d2bcab5a7943c8a",
            "modified_time": "2026-06-29T05:59:14Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2026-07-09T17:19:25.447232313Z",
            "id": "IN-MAL-2026-009334",
            "sha256": "26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9",
            "modified_time": "2026-07-09T16:57:23Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / checkmarx-claude-cache

Package

Name: checkmarx-claude-cache; View open source insights on deps.dev
Purl: pkg:npm/checkmarx-claude-cache

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.0.1

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "bin/cli.js",
            "tlsh": "0c417369acfa58720ab6e4c5516b942ab00341027247ef507adc58542fcb278ce3b7ee",
            "sha256": "a96cba980375021aa8b9226296075a8c8fb5dfee328eade4ce3a44b6b82932c1"
        },
        {
            "path": "package.json",
            "tlsh": "19e026104a607d7314ccbda10d33830261689c1b93487d0d22db612c43ac6fa1efb68c",
            "sha256": "34b5023ba4eb9cb61635566fceca85ef23815ad49805023425d10ca88bca657f"
        }
    ],
    "package_integrity": [
        {
            "filename": "checkmarx-claude-cache-1.0.0.tgz",
            "hashes": {
                "sha1": "ccb31aa54d14b349b0f4fae23cc8c6eed82d6cd0",
                "sha512_sri": "sha512-T22kH1qrnuGmn3c8UXYP55VyDWsPsgpKVbXHyXbOVJ2U+kC/Hzsk+RFpQB5O4Vb2r/MXEgxSHecL5Qfr5LgdQg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkmarx-claude-cache/MAL-2026-6576.json"