{"id":"MAL-2026-12640","summary":"Malicious code in claims-policy-details-domain (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ddd2a9e4dd34aac1232648e9e5f459331bd73d0f3779ed68ac559d8f4692c9bb)\nOn require() of claims-policy-details-domain, index.js loads _vendor.js which downloads a platform-specific binary from anonymous Cloudflare workers.dev subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT covert-channel fallback under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) that retrieves base64-chunked payload bytes via resolveTxt of c.\u003cdomain\u003e and \u003cN\u003e.\u003cdomain\u003e. The fetched bytes are written to disguised paths in /var/tmp or %TEMP% (e.g..cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmod 0o755, and spawned detached via /bin/sh -c or cmd.exe /c start /b (_vendor.js line 119, 121, 125). C2 hostnames are assembled from split string fragments to evade static analysis, and generic opt-out env vars plus a TTL cache reduce re-execution and observability. The package presents as an internal-namespace SDK at an unusually high version (35.9.3) with a trivial declared surface and an 81KB stub lib/telemetry.js, consistent with a dependency-confusion lure whose only material behavior is the dropper.\n","modified":"2026-08-05T14:36:03.017250945Z","published":"2026-08-05T14:01:35Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:20:05.493459294Z","modified_time":"2026-08-05T14:01:35Z","sha256":"ddd2a9e4dd34aac1232648e9e5f459331bd73d0f3779ed68ac559d8f4692c9bb","source":"amazon-inspector","versions":["35.9.3"],"id":"IN-MAL-2026-015134"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-policy-details-domain/v/35.9.3"}],"affected":[{"package":{"name":"claims-policy-details-domain","ecosystem":"npm","purl":"pkg:npm/claims-policy-details-domain"},"versions":["35.9.3"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"75a1a69616a670088bb0dbf48717581af55bf6633380c294fb5c69885f7256483b2efc","path":"_vendor.js","sha256":"a76afbcb995e6c4a9ff47c0145885f8856d18a45e53e1d4fdbd834b621ae5936"},{"path":"package.json","sha256":"cae1205bd3d3e1308d3069c2afd3e9875875e4beb6096fe5269b2eb6b94125c9","tlsh":"dcd0a9624652a97b00f4e7cc68b5eb0bbe823f1f30788d063933622840e037518b831a"}],"package_integrity":[{"filename":"claims-policy-details-domain-35.9.3.tgz","hashes":{"sha1":"d1dd4a490429ccb7d3fa718ac060973865dc6192","sha512_sri":"sha512-R7LOxjNuPuOn1BCO8uq1qqZ7RNnRFBa73vtNILjAMK18w+XqXIPNhqaXGYRZYJ5cG9GV3ctvEAcJ3WS6jdbG4Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-policy-details-domain/MAL-2026-12640.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}