{"id":"MAL-2026-13503","summary":"Malicious code in distributorblock (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea)\nThe package's main entry (index.js) re-exports a decoy telemetry module and unconditionally require()s setup.js. On require, setup.js selects a platform-specific path, downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts under oob-worker.cf*.workers.dev (assembled via string concatenation to obscure the literal), writes it to /var/tmp/.cache_\u003chex\u003e on POSIX or %TEMP%\\dotnet_diag_\u003chex\u003e.exe on Windows, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref(). A /tmp flag file rate-limits repeated runs and a DO_NOT_TRACK check gates execution. When HTTP retrieval fails, setup.js reassembles the payload from base64-encoded chunks served over DNS TXT records at c.\u003cdomain\u003e and 0..N.\u003cdomain\u003e under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru — a covert channel that bypasses HTTP egress controls. The package's declared purpose (\"API client wrappers\") is inconsistent with fetching and executing a native binary at import time, and author metadata is empty. The naming (.cache_, dotnet_diag_), detached spawn, and DNS-TXT fallback are consistent with a trojan dropper designed to evade both sandboxing and network defenses.\n","modified":"2026-08-07T12:35:11.234965610Z","published":"2026-08-07T12:11:18Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-07T12:11:18Z","sha256":"f8b9a4f0d7d51b904c51afac9543f8acc9e91d33277512dc9294a24e966903ea","source":"amazon-inspector","versions":["35.8.1"],"id":"IN-MAL-2026-016875","import_time":"2026-08-07T12:23:25.349793508Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/distributorblock/v/35.8.1"}],"affected":[{"package":{"name":"distributorblock","ecosystem":"npm","purl":"pkg:npm/distributorblock"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"bf9b4cd5823541f67d4bd394c33e53a802728ecc35a32b1f2152f1a66c6bebb8","tlsh":"56a1a75519fa70180792e5d4841b6816b19ef6933384e4d8fb8ca6884fd7628c3f3aec","path":"setup.js"},{"path":"index.js","sha256":"096488fa68e6d1b2eefd3cb161117182f5651f8938c4290de624401358913fb3","tlsh":"0dc022a62ae42083014027dac863d0c322e2c2342280b1e44ad682bf4a8d8ca037ac00"}],"package_integrity":[{"filename":"distributorblock-35.8.1.tgz","hashes":{"sha1":"1926219998951aeef9be57b0b8989c6f77c803b8","sha512_sri":"sha512-83FzN570DlCiNnx/lKriqg97LuO3nj47Jva4Kh0qcKMQGRQL0CmmszPT0IPQUyvSopXUuAAgnurmMzeJqO1xbQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/distributorblock/MAL-2026-13503.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}