{"id":"MAL-2026-12616","summary":"Malicious code in claims-format-date (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd)\nclaims-format-date@35.6.5 auto-executes a binary dropper when the module is required. index.js requires./_init on load; _init.js downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT base64-chunk fallback through sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_\u003cuid\u003e, dotnet_diag_\u003cuid\u003e.exe), chmod 0755, and detached-spawned via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API references are reconstructed at runtime through array joins and string concatenation (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade static analysis. A second parallel dropper implementation in lib/telemetry.js decodes a base64 buffer and performs the same write/chmod/exec chain under an 'analytics SDK' cover story. The package name resembles common date-formatting utilities but the shipped code implements remote payload execution on require.\n","modified":"2026-08-05T14:35:50.933435805Z","published":"2026-08-05T14:05:26Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:20:08.083634659Z","modified_time":"2026-08-05T14:05:26Z","sha256":"776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd","source":"amazon-inspector","versions":["35.6.5"],"id":"IN-MAL-2026-015159"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-format-date/v/35.6.5"}],"affected":[{"package":{"name":"claims-format-date","ecosystem":"npm","purl":"pkg:npm/claims-format-date"},"versions":["35.6.5"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"b1a177aa15a670094bb097e4c7275416f65be7633280c294fb5ca9885f7612483b2efc","path":"_init.js","sha256":"0a2cb1b6e761a1c83eca2cbd80d366a25f770c4a2faa94842d2f45c6e15a0586"},{"path":"lib/telemetry.js","sha256":"9c5b5f3fcf1e13153bd1b91fa47a922e8bd6a84a914ca0bd4705265d92eb6398","tlsh":"09835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"hashes":{"sha1":"9c468a303017ae2b41fb421ee941fd7acdc65d15","sha512_sri":"sha512-gsJAtNS0Y25ZRbpkS2EfzQ3P+vJZJGKnHk0Kc5DkUT4Zs/EJDVJU2bI5Kcc9HM4ZW3c/cTUPNhl5KBME4XbhXg=="},"filename":"claims-format-date-35.6.5.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-format-date/MAL-2026-12616.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}