{"id":"MAL-2026-12647","summary":"Malicious code in claims-use-callback-once (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1)\nOn require() of claims-use-callback-once, index.js unconditionally loads _shim.js which selects a platform-specific payload path, fetches an executable from one of several hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback over *.dl.wel1.ru (ext./pkg./net.dl.wel1.ru), writes the payload to /tmp or %TEMP% under a deceptive Microsoft-diagnostics-style name (e.g. dotnet_diag_\u003chex\u003e.exe,.cache_\u003chex\u003e), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. Host strings and sensitive Node API names (child_process, chmodSync) are assembled at runtime via array joins and string concatenation to evade static analysis. lib/telemetry.js bundles a parallel dropper implementation (DNS TXT base64 payload assembly, chmod 0755, detached shell spawn) presented as an 'Analytics SDK' cover story. The package name resembles a callback utility but the shipped code has no such functionality.\n","modified":"2026-08-05T14:36:06.627081643Z","published":"2026-08-05T13:59:54Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T13:59:54Z","sha256":"0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1","source":"amazon-inspector","versions":["35.6.7"],"id":"IN-MAL-2026-015123","import_time":"2026-08-05T14:20:04.447299762Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-use-callback-once/v/35.6.7"}],"affected":[{"package":{"name":"claims-use-callback-once","ecosystem":"npm","purl":"pkg:npm/claims-use-callback-once"},"versions":["35.6.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"de71b21bc14dda5135f5505fc5e68286e301023adb1e2fd94432580160b7d1f5","tlsh":"40a1859a16a570188bb0ebf487175415f65bf6633780c2d4fbac69941fb312482b2efc","path":"_shim.js"},{"sha256":"3931f7780ca9bc8d3a45466b1dc007ef3a4881f893f1f0dbb9d69b3b20928287","tlsh":"f0835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}],"package_integrity":[{"filename":"claims-use-callback-once-35.6.7.tgz","hashes":{"sha512_sri":"sha512-KOFXkErpzXIXp78S9JAhHE+b7WaN8MA8c/KYyusyVGyjTTA6BIs+1DPOGfJPBtaErdbsIq0f/P299stdbzafIg==","sha1":"1134c177ecb282d05bdb2dc632703b2062d1ff1e"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claims-use-callback-once/MAL-2026-12647.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}