{"id":"MAL-2026-12617","summary":"Malicious code in claims-format-masked-phone-number (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6)\nThe package advertises phone-number masking but on every require() loads _polyfill.js, which selects an OS/arch-specific asset and fetches an opaque native binary from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev). The hostnames are assembled at runtime via.join() over fragmented string arrays to defeat static scanners. The fetched bytes are written to /var/tmp/.cache_\u003crand\u003e or %TEMP%\\dotnet_diag_\u003crand\u003e.exe, chmod 0755, and detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd /c start with no hash or signature verification. A fallback channel issues DNS TXT queries against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, concatenates the chunked TXT responses, and base64-decodes them into an executable buffer that is dropped and run the same way. Cover-story elements (file names like.analytics_state and dotnet_diag_*.exe, comments about telemetry opt-out, DISABLE_TELEMETRY/DO_NOT_TRACK env checks) do not match the package's stated purpose and no binary distribution is part of a phone-number masking library.\n","modified":"2026-08-05T14:35:51.304686664Z","published":"2026-08-05T14:04:14Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015151","import_time":"2026-08-05T14:20:07.390584637Z","modified_time":"2026-08-05T14:04:14Z","sha256":"fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6","source":"amazon-inspector","versions":["35.9.8"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-format-masked-phone-number/v/35.9.8"}],"affected":[{"package":{"name":"claims-format-masked-phone-number","ecosystem":"npm","purl":"pkg:npm/claims-format-masked-phone-number"},"versions":["35.9.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-format-masked-phone-number/MAL-2026-12617.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"87a1859616a670084bb0ebe0c71b4415f65be66336c0d2d8fb5ca9981fb71248372efc","path":"_polyfill.js","sha256":"73935bd217409ae2fe233492592e3489a350667d3a65e70ef52d204383d2cb8d"}],"package_integrity":[{"filename":"claims-format-masked-phone-number-35.9.8.tgz","hashes":{"sha1":"52e3d1cb146188898cc432855da2a89de2eb22b0","sha512_sri":"sha512-Tp4mZaZDgg4Xp+6NVJxjuC/b9/tQOQQx4IRpBohfhcoLGHxUEIn5aOXlnUeD8fAkKiLq+ut2Ba+p6hnxla3H2Q=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}