{"id":"MAL-2026-12536","summary":"Malicious code in cardsmobile-storage (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b)\nOn require(), index.js loads _shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded binary is written to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on POSIX, dotnet_diag_\u003chex\u003e.exe on Windows), chmod 0755 is applied on POSIX, and the file is spawned detached and unref'd via /bin/sh -c or cmd.exe/start. Host names and the child_process module name are assembled at runtime from split-string arrays (require(\"child_\" + \"process\"), [\"oob-worke\",\"r.cf99-9b3\",\".wor\",\"kers.d\",\"ev\"].join(\"\")) to evade static URL/module scanners. A parallel dropper implementation with the same primitives (HTTPS with endpoint rotation, DNS-TXT base64 service discovery, fs.chmodSync 0o755, cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"])) is bundled in lib/telemetry.js (81 KB, labeled as an \"Analytics SDK\") and shipped in the tarball as an alternate execution path.\n","modified":"2026-08-05T14:35:05.847590919Z","published":"2026-08-05T14:16:38Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:16:38Z","sha256":"c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b","source":"amazon-inspector","versions":["35.6.5"],"id":"IN-MAL-2026-015236","import_time":"2026-08-05T14:20:15.460825448Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cardsmobile-storage/v/35.6.5"}],"affected":[{"package":{"name":"cardsmobile-storage","ecosystem":"npm","purl":"pkg:npm/cardsmobile-storage"},"versions":["35.6.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cardsmobile-storage/MAL-2026-12536.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"80d74d135f0549c5358d096c41f60eff590bd43f","sha512_sri":"sha512-EsecZ45s8mEcJ1LFgIkmVvyVw0jnwIWXGSlgeQBMECUPYDEfwU4TRawLlDtrgEavtTarPExOrvyH3PoGTM21Tw=="},"filename":"cardsmobile-storage-35.6.5.tgz"}],"evidence_files":[{"tlsh":"49a1b75a06a6701c4b70a7e0c71b882af55bf2633781c2d4fbac55945f7252483b2efc","path":"_shim.js","sha256":"bb1f7255969130ade3854c1b4ed128e87310f3f3a52da6653bbdeb40162ab2ca"},{"tlsh":"e9835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"f14609817d27c3b6672f1d5d7d300550347dd36a6847afa6127e61308e34e788"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}