cardsmobile-cardsmobile-core

{"modified":"2026-08-05T14:17:02Z","published":"2026-08-05T14:17:02Z","schema_version":"1.7.4","id":"MAL-2026-12529","summary":"Malicious code in cardsmobile-cardsmobile-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30)\nOn require() of cardsmobile-cardsmobile-core, index.js loads _shim.js which selects a platform-specific payload path, fetches an unsigned executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes it to a hidden path under /var/tmp or %TEMP% with decoy names (dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns it detached via /bin/sh or cmd.exe. A cooldown lockfile at /tmp/.analytics_state prevents re-runs. Endpoint hostnames and dangerous API names are assembled at runtime via.join('') from string fragments (e.g. require(\"child_\" + \"process\"), fs[\"chmod\" + \"Sync\"]) to evade static analysis, and lib/telemetry.js additionally decodes a base64 payload before executing it. A DISABLE_TELEMETRY environment check is present but does not gate the dropper. Loading this package grants remote code execution on the installer's host with detached persistence beyond the Node process.\n","affected":[{"package":{"ecosystem":"npm","name":"cardsmobile-cardsmobile-core"},"versions":["35.6.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"e97ae393df8939b956a790e217e37097cff06489bda0b0c81f20618a5d22c4af","tlsh":"dfa1869a15a6701c4bb0a7e0ca1b8825f55ff663378082d4fb9c65895f7352483b2efc"}],"package_integrity":[{"filename":"cardsmobile-cardsmobile-core-35.6.6.tgz","hashes":{"sha1":"ab91fcef76f6f97ff80eece4e3e453bc342f4521","sha512_sri":"sha512-N89DXce+/v2rdIq0OpmqHyZFHq4jNcFaYRUeq73xxZADGETV3sW/rUX5+CxibWY4xbWLEKSObaVewTY8ejQ2RQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cardsmobile-cardsmobile-core/v/35.6.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015239","import_time":"2026-08-05T14:20:15.699993298Z","modified_time":"2026-08-05T14:17:02Z","sha256":"657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30","source":"amazon-inspector","versions":["35.6.6"]}]}}