{"id":"MAL-2026-12606","summary":"Malicious code in claims-api-clients-shared (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (95f8c902163c7dda0fc907a90fc4a71fbc08fcd1574e8cfcee53915674109a86)\nclaims-api-clients-shared@35.1.9 advertises itself as a REST client wrapper, but index.js unconditionally requires _shim.js, whose main() runs on load. On import, _shim.js fetches a platform-specific binary over HTTPS from Cloudflare Workers hostnames assembled via string-array joins (oob-worker.cf99-9b3.workers.dev and sibling cf102-baf / cf103-070 / cf100-416 subdomains), with a DNS-TXT chunked base64 fallback resolving through sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched payload is written to a temp path under cover-story names (dotnet_diag_\u003chex\u003e.exe on Windows,.cache_\u003chex\u003e on POSIX), chmodded 0755, and spawned detached/unref'd via /bin/sh -c or cmd. No hash or signature verification is performed and the destinations are not owned by the package publisher. child_process is loaded through require(\"child_\"+\"process\") and hostnames are split into fragments and reassembled at runtime to evade static URL scanners. A separate lib/telemetry.js (~81 KB, unreferenced from index.js) mirrors the dropper's vocabulary (.analytics_state, DISABLE_TELEMETRY/ANALYTICS_OPT_OUT), serving as a cover story rather than functionality the stated purpose requires.\n","modified":"2026-08-05T14:35:45.888058704Z","published":"2026-08-05T14:06:16Z","database_specific":{"malicious-packages-origins":[{"sha256":"95f8c902163c7dda0fc907a90fc4a71fbc08fcd1574e8cfcee53915674109a86","source":"amazon-inspector","versions":["35.1.9"],"id":"IN-MAL-2026-015165","import_time":"2026-08-05T14:20:08.626767618Z","modified_time":"2026-08-05T14:06:16Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-api-clients-shared/v/35.1.9"}],"affected":[{"package":{"name":"claims-api-clients-shared","ecosystem":"npm","purl":"pkg:npm/claims-api-clients-shared"},"versions":["35.1.9"],"database_specific":{"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"2e78d0b9a25cfb95543031942a0f5d156ca7b4d1fd101fa2d7aa6a9148ebb887","tlsh":"93a1865a06aa70184bb0ebe4cb1b4819f65afa5337818284f79c69945f73514c3b2efc"}],"package_integrity":[{"filename":"claims-api-clients-shared-35.1.9.tgz","hashes":{"sha512_sri":"sha512-QGLqpTXXWXsnNi1mVw4YHpv1odNXH38SvsISEaQEoXfaqwrkrf93QvJIaBYHWOniZqdviYQG5hmOwNR6l28sEw==","sha1":"c70900ffc3fb9566607ded52a2cdc245d1520671"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-api-clients-shared/MAL-2026-12606.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}