{"id":"MAL-2026-12529","summary":"Malicious code in cardsmobile-cardsmobile-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30)\nOn require() of cardsmobile-cardsmobile-core, index.js loads _shim.js which selects a platform-specific payload path, fetches an unsigned executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes it to a hidden path under /var/tmp or %TEMP% with decoy names (dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns it detached via /bin/sh or cmd.exe. A cooldown lockfile at /tmp/.analytics_state prevents re-runs. Endpoint hostnames and dangerous API names are assembled at runtime via.join('') from string fragments (e.g. require(\"child_\" + \"process\"), fs[\"chmod\" + \"Sync\"]) to evade static analysis, and lib/telemetry.js additionally decodes a base64 payload before executing it. A DISABLE_TELEMETRY environment check is present but does not gate the dropper. Loading this package grants remote code execution on the installer's host with detached persistence beyond the Node process.\n","modified":"2026-08-05T14:35:00.557053985Z","published":"2026-08-05T14:17:02Z","database_specific":{"malicious-packages-origins":[{"sha256":"657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30","source":"amazon-inspector","versions":["35.6.6"],"id":"IN-MAL-2026-015239","import_time":"2026-08-05T14:20:15.699993298Z","modified_time":"2026-08-05T14:17:02Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cardsmobile-cardsmobile-core/v/35.6.6"}],"affected":[{"package":{"name":"cardsmobile-cardsmobile-core","ecosystem":"npm","purl":"pkg:npm/cardsmobile-cardsmobile-core"},"versions":["35.6.6"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"e97ae393df8939b956a790e217e37097cff06489bda0b0c81f20618a5d22c4af","tlsh":"dfa1869a15a6701c4bb0a7e0ca1b8825f55ff663378082d4fb9c65895f7352483b2efc","path":"_shim.js"}],"package_integrity":[{"hashes":{"sha1":"ab91fcef76f6f97ff80eece4e3e453bc342f4521","sha512_sri":"sha512-N89DXce+/v2rdIq0OpmqHyZFHq4jNcFaYRUeq73xxZADGETV3sW/rUX5+CxibWY4xbWLEKSObaVewTY8ejQ2RQ=="},"filename":"cardsmobile-cardsmobile-core-35.6.6.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cardsmobile-cardsmobile-core/MAL-2026-12529.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}