{"id":"MAL-2026-12618","summary":"Malicious code in claims-format-money (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009)\nThe package's index.js requires _bootstrap.js on import. _bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments (assembling oob-worker.cf*-*.workers.dev hosts with DNS TXT fallback to *.wel1.ru), downloads an unpinned platform-specific binary, writes it to /var/tmp or %TEMP% under cover-story names such as dotnet_diag_\u003csuffix\u003e.exe and.cache_\u003csuffix\u003e, calls chmodSync(0o755), and spawns it detached via /bin/sh -c or cmd.exe with.unref(). A marker file.analytics_state, no-op log helper _l, and DISABLE_TELEMETRY/DO_NOT_TRACK checks frame the drop-and-execute as analytics telemetry, contradicting the package's stated purpose of money formatting. A second implementation of the same fetch-\u003echmod-\u003espawn primitive is shipped in lib/telemetry.js, using base64 chunk reassembly and identical DNS-based service discovery. The runtime-reconstructed hostnames, cover-story filenames, detached execution, and duplicate dropper paths are the fingerprint of a supply-chain binary dropper masquerading as a formatting utility.\n","modified":"2026-08-05T14:35:51.560060120Z","published":"2026-08-05T14:05:16Z","database_specific":{"malicious-packages-origins":[{"versions":["35.5.5"],"id":"IN-MAL-2026-015158","import_time":"2026-08-05T14:20:07.991072371Z","modified_time":"2026-08-05T14:05:16Z","sha256":"bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-format-money/v/35.5.5"}],"affected":[{"package":{"name":"claims-format-money","ecosystem":"npm","purl":"pkg:npm/claims-format-money"},"versions":["35.5.5"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"c8e0277f3d44f40b7a9b5073282722e4b5da795618a2231fd15500dc18001079","tlsh":"b6a1a85a15a67008c7b09bf48b17581af69bf6733780c298f75c69985f7242483b2efc"},{"path":"lib/telemetry.js","sha256":"c53c8fc7714def7eec0e25ed0235ab5cf1748bb64965d4f82d13689dffc444df","tlsh":"57835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"claims-format-money-35.5.5.tgz","hashes":{"sha1":"4ad329b13b1b44ef406b132c530a383fad7ea7f0","sha512_sri":"sha512-wUYRVs7HHqjPBITovdo6G0y1D72QGwpoP70APgGKS9+j3XcrFpm9sS5rclTBsTtayh6dO1NJdvnSNjverEVlug=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-format-money/MAL-2026-12618.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}