{"id":"MAL-2026-4349","summary":"Malicious code in clob.api (npm)","details":"A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executable from IPFS on `postinstall`. The dropper fetches the binary from IPFS CID `bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa` via multiple public gateways (Pinata, Cloudflare, ipfs.io), drops it to `%LOCALAPPDATA%`, registers Windows Registry persistence under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` using a hidden VBScript wrapper (window style 0, no taskbar entry), launches the payload immediately, and reports the victim's public IP address to a hardcoded C2 server via HTTP POST. macOS and Linux stubs are present but not yet configured. Developer artifacts bundled in `config/meta_data.json` leak the attacker's build path: `E:\\getting IP and check list\\clob-downloader\\`.\n\n`clob.api` bundles `clob2.0.exe` (≈4 MB) directly in the package tarball and also attempts to fetch an identical copy from IPFS at install time. Its `postinstall` script runs `clob.js`, which drops the executable to `%LOCALAPPDATA%\\clob2.0.exe`. The C2 beacon transmits the victim's public IP to `http://45.8.22.112:2026/api/urls`.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2788e534ad4bce2154871c16cb6a6f35eed923f96bae6ca4bf041e197c30ed8a)\nOn install, package.json's postinstall hook runs node clob.js, which (1) downloads clob2.0.exe (Windows) or clob (macOS/Linux) from IPFS gateways including violet-tricky-quelea-562.mypinata.cloud, cloudflare-ipfs.com, ipfs.io, and gateway.pinata.cloud, falling back to a 4 MB clob2.0.exe PE binary bundled directly in the tarball; (2) writes the binary to %LOCALAPPDATA% / ~/.local/bin and launches it hidden via a generated VBS launcher invoked through wscript.exe //nologo with windowsHide:true; (3) installs autorun across all three operating systems — HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run on Windows, ~/Library/LaunchAgents/com.clob.agent.plist with launchctl load on macOS, and ~/.config/autostart/clob.desktop on Linux; and (4) resolves the installer's public IP via api.ipify.org and POSTs it to a hardcoded bare-IP C2 endpoint at http://45.8.22.112:2026/api/urls?url=\u003cpublic_ip\u003e. The README is verbatim copied from @img/sharp-win32-x64 to impersonate the legitimate Sharp prebuilt, while package.json's own description (\"Downloads clob2.0.exe on install\") contradicts the README — this is deliberate camouflage. The bundled PE is undocumented and serves no advertised purpose.\n","modified":"2026-05-26T06:02:23.191326192Z","published":"2026-05-25T12:02:02Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-05-26T05:52:59.656640519Z","sha256":"2788e534ad4bce2154871c16cb6a6f35eed923f96bae6ca4bf041e197c30ed8a","source":"amazon-inspector","versions":["2.73.0"],"id":"IN-MAL-2026-004636","modified_time":"2026-05-25T12:02:02Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/clob.api/v/2.73.0"}],"affected":[{"package":{"name":"clob.api","ecosystem":"npm","purl":"pkg:npm/clob.api"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["2.73.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clob.api/MAL-2026-4349.json","indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-E5vmuKWiHwqaIbnznAsKen4WosxtUoVKhrNhsuEA+KaWxV66paqWuT03QA/TqN9X4M2jiglKIED/arxW4+mOhw==","sha1":"7436f3b369b423a4b8bd3e7eca8903412d934b17"},"filename":"clob.api-2.73.0.tgz"}],"evidence_files":[{"path":"clob.js","tlsh":"7412857a9af2612139b3d58dab0b441a6417b4073109ec54fa5cb35e6fcf02cc5a16fe","sha256":"954728b16738a4b44696a599eecde211ece2ccfcc9eb47bfaf4ba5c3ab6715be"},{"path":"README.md","tlsh":"fba1c0fe2c045a632ff1c9c67e0fad4fef19914c668e2d8874de9050632122969ec160","sha256":"c416cd0af88256407c36a0613f189ac4257221c7206d0324f7ef5563c66f1125"},{"path":"clob2.0.exe","tlsh":"e9168d43f68592e9c0aec074c25b5237e376fc894a20679b73985b212f66b601f5f39c","sha256":"300a7dea05c2a588757010ad314fa55cb8ef3acebaa284f58a5cd0fd39bce478"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}