{"id":"MAL-2026-12645","summary":"Malicious code in claims-types (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e)\nOn require('claims-types'), index.js loads./_platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose names are assembled by string-splitting (e.g. oob-worker.cf10{0,1,2,3}-*.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). A stamp file (.analytics_state) gates re-runs by TTL, providing periodic re-fetch. If HTTPS retrieval fails, _platform.js falls back to a DNS TXT covert channel: it resolves c.\u003cdomain\u003e at *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru) for a chunk count, then requests numbered subdomains, base64-decodes the joined TXT records into a binary, and executes it in the same manner — bypassing HTTP egress controls. Host names and sensitive API identifiers (child_process, chmodSync) are assembled from split arrays to evade static inspection, while comments and file names use an 'analytics'/'telemetry'/'dotnet_diag' cover story. A second dropper module at lib/telemetry.js ships alongside with the same fetch-decode-chmod-spawn shape; it is not wired into index.js in this version but is present in the tarball.\n","modified":"2026-08-05T14:36:05.607383828Z","published":"2026-08-05T13:59:36Z","database_specific":{"malicious-packages-origins":[{"versions":["35.8.3"],"id":"IN-MAL-2026-015121","import_time":"2026-08-05T14:20:04.249817281Z","modified_time":"2026-08-05T13:59:36Z","sha256":"47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-types/v/35.8.3"}],"affected":[{"package":{"name":"claims-types","ecosystem":"npm","purl":"pkg:npm/claims-types"},"versions":["35.8.3"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-types/MAL-2026-12645.json","indicators":{"evidence_files":[{"path":"_platform.js","sha256":"c59a43b2e6fde07dd648331a2d417af2d63ef2f959c80eb6d00d6d88d591621b","tlsh":"fda1cb9a16a670194b709be4c7174416f65bf66337c0d184fb5ca9981fb312483b2efc"},{"tlsh":"df835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"89ad3eda35d91e706d4e5d2c91832290a34abfaa06f425d51c8cf19aa56d80f1"}],"package_integrity":[{"filename":"claims-types-35.8.3.tgz","hashes":{"sha1":"792045736716bdd4a308ed7af5cb8cc312f6dd02","sha512_sri":"sha512-t0agrWFnl/CfLSMIAl5jOW8ExKETR7bLGt26jksEFiWVzorZqF3eOZy9NRzMMY+d7yFmF7MTtjTKLvgLYtqZ5A=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}