{"id":"MAL-2026-12614","summary":"Malicious code in claims-enums (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e)\nOn require('claims-enums'), index.js loads _polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS-TXT chunked fallbacks resolved from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to /tmp or %TEMP% under cover-story filenames (e.g. dotnet_diag_\u003chex\u003e.exe,.cache_\u003chex\u003e), chmod'd 0755, and detach-spawned via /bin/sh or cmd.exe. Hostnames, the child_process import, and fs.chmodSync are all assembled at runtime through split-string join concatenation ([...].join(\"\"), require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to defeat static analysis; the same obfuscation appears in the unreferenced sibling lib/telemetry.js. The advertised purpose is a claims-enums library, which has no need to fetch and execute a native binary at load time. A DISABLE_TELEMETRY environment check is present as cover framing.\n","modified":"2026-08-05T14:35:49.929474088Z","published":"2026-08-05T14:04:23Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.7.6"],"id":"IN-MAL-2026-015152","import_time":"2026-08-05T14:20:07.4705247Z","modified_time":"2026-08-05T14:04:23Z","sha256":"b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-enums/v/35.7.6"}],"affected":[{"package":{"name":"claims-enums","ecosystem":"npm","purl":"pkg:npm/claims-enums"},"versions":["35.7.6"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"159c30a8cd98e7758f792b065d36dce94a78b08b178236c64b73ee9d7c83f578","tlsh":"80a1b99a02a570188f70ebe4c7179826f65af66337808284fb9c65945fb3654c3b2dfc","path":"_polyfill.js"}],"package_integrity":[{"hashes":{"sha1":"d14cf3e45f40bd3ae45556cdcd2b5bfc75b13673","sha512_sri":"sha512-e4YVNzkW3FnS2cOCK9LetMU1sUtWuQyt2xqpm83jA2JtitNVaNa2NPMJvdJBMiOTGgailqW7QHXe2yrrZnXJ+w=="},"filename":"claims-enums-35.7.6.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-enums/MAL-2026-12614.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}