{"id":"MAL-2026-12624","summary":"Malicious code in claims-historical-claims-api-adapters (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997)\nindex.js unconditionally requires _loader.js on module load. _loader.js reconstructs remote hostnames from split string fragments (e.g. [\"oob-worker.cf99-9b\",\"3.wo\",\"rk\",\"ers.d\",\"ev\"].join(\"\")) to yield oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Based on process.platform, a binary is downloaded over HTTPS, written to /var/tmp or %TEMP% under a disguised name (.cache_\u003crand\u003e or dotnet_diag_\u003crand\u003e.exe), chmod'd 0755, and spawned detached via cp.spawn(\"/bin/sh\",[\"-c\", fp+\" &\"],{detached:true,stdio:\"ignore\"}).unref(). A parallel dropper module lib/telemetry.js, framed as an 'Analytics SDK', ships the same fetch-write-exec shape with require(\"child_\"+\"process\") and fs[\"chmod\"+\"Sync\"] dynamic property assembly. The obfuscation of host strings and module names, disguised filenames, and detached background execution are consistent with a canonical import-time RCE dropper.\n","modified":"2026-08-05T14:35:55.345436544Z","published":"2026-08-05T14:03:58Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:03:58Z","sha256":"b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997","source":"amazon-inspector","versions":["35.7.6"],"id":"IN-MAL-2026-015149","import_time":"2026-08-05T14:20:07.192600345Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-historical-claims-api-adapters/v/35.7.6"}],"affected":[{"package":{"name":"claims-historical-claims-api-adapters","ecosystem":"npm","purl":"pkg:npm/claims-historical-claims-api-adapters"},"versions":["35.7.6"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"claims-historical-claims-api-adapters-35.7.6.tgz","hashes":{"sha1":"b73a4fc0854b6643cfe39e4a8a93bc3e809c3c28","sha512_sri":"sha512-MvUVEU/Rkf/Ekwuo3qv43R+YmLKEZ1hVpG/7axER6+5BlDTpfdjb+P7CLvbNtukBDoZHdcG1fw5DlAy9rqu/lw=="}}],"evidence_files":[{"path":"_loader.js","sha256":"35bcdc930c71999afbadd586a6e7e0c62998ae87b2809865eaf76e5fdea611a4","tlsh":"bca1b76a12a670198bb0d7e487175416f65bf6733781c2c8fb5ca5841f7212483b2efc"},{"path":"lib/telemetry.js","sha256":"374259cc2ad1a75155c308097327f3b2f01312293d5b577a000ea4f8576fedfb","tlsh":"d8835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-historical-claims-api-adapters/MAL-2026-12624.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}