cards-forms-clone-debit-clone

{"modified":"2026-08-05T14:19:21Z","published":"2026-08-05T14:19:21Z","schema_version":"1.7.4","id":"MAL-2026-12526","summary":"Malicious code in cards-forms-clone-debit-clone (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4)\nOn require(), index.js loads _bootstrap.js which reconstructs endpoint hostnames from split string fragments (assembling *.workers.dev hosts such as oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf, with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary, writes it under a decoy filename ('dotnet_diag_<hex>.exe' on Windows, '.cache_<hex>' on POSIX) into /tmp or %TEMP%, chmods it 0755, and detach-spawns it via '/bin/sh -c <path> &' or 'cmd.exe /c start /b'. No hash or signature verification is performed and the fetch URLs are unpinned. Telemetry-style cover strings ('.analytics_state', DISABLE_TELEMETRY / DO_NOT_TRACK env-var gating) and host-string reassembly conceal the C2 destinations and the nature of the dropped executable.\n","affected":[{"package":{"ecosystem":"npm","name":"cards-forms-clone-debit-clone"},"versions":["35.8.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"215eff626673525cc15948d7b45c7003e23b37ac41cb899516ddddf0dfbcb0d8","tlsh":"5da1969a16a6700d8bb0d7e4c7175816f65be6633781c294fb5ca5881f7212483b2efc"}],"package_integrity":[{"filename":"cards-forms-clone-debit-clone-35.8.6.tgz","hashes":{"sha1":"ea0edc680bbcbf6c88f16600147e8940c6453cdf","sha512_sri":"sha512-1qb5uEHkEFswMSYAqidGurOJvRHWyAYoy3LIfUmzJpjjY5mJBIUgU6NxMdg3g57h6Ega6cQ5UmZ1imXFnPIXxQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cards-forms-clone-debit-clone/v/35.8.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015255","import_time":"2026-08-05T14:20:17.087040239Z","modified_time":"2026-08-05T14:19:21Z","sha256":"af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4","source":"amazon-inspector","versions":["35.8.6"]}]}}