{"id":"MAL-2026-13281","summary":"Malicious code in docsmate-docsmate-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e)\nOn require(), index.js loads _support.js which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf, cf102-baf) from split string fragments, with a DNS-TXT fallback resolver chain across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. It downloads an OS/arch-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_\u003chex\u003e.exe on Windows,.cache_\u003chex\u003e on Unix), chmods 0755, and detaches it via spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or spawn('cmd',...). A stamp file suppresses re-runs and environment variables can disable execution. The package presents itself as a platform/core types library and ships no shipped native source that would justify fetching and executing an opaque binary at import time. Destination hosts are string-obfuscated to evade static inspection, and the dropped file is named to impersonate a Microsoft.NET diagnostic tool.\n","modified":"2026-08-05T16:50:31.861327242Z","published":"2026-08-05T15:29:07Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T16:13:35.530544701Z","modified_time":"2026-08-05T15:29:07Z","sha256":"9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e","source":"amazon-inspector","versions":["35.9.3"],"id":"IN-MAL-2026-015716"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/docsmate-docsmate-core/v/35.9.3"}],"affected":[{"package":{"name":"docsmate-docsmate-core","ecosystem":"npm","purl":"pkg:npm/docsmate-docsmate-core"},"versions":["35.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-zbDUxWJfGHYoYJtjfGrxUtCGiE2AN2HjX1oSCesdHFdEdoZTFyi4Y0vjUDGSsj7ch0om/0BZaKiDlwC9BtqFkg==","sha1":"bbdfe1d9920eb283384ebf25518e9c7d2441c4c2"},"filename":"docsmate-docsmate-core-35.9.3.tgz"}],"evidence_files":[{"path":"_support.js","sha256":"40c79432762782f32d31c3a7c1cdc71370eeea0d06630e40427cf8c1e9b79532","tlsh":"31a1975b156a70188b709bf0c7174816f65bf6633380c584fb9ca9985f7252483b2efc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/docsmate-docsmate-core/MAL-2026-13281.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}