cardsmobile-rs-api

{"modified":"2026-08-05T14:17:49Z","published":"2026-08-05T14:17:49Z","schema_version":"1.7.4","id":"MAL-2026-12535","summary":"Malicious code in cardsmobile-rs-api (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608)\nOn require('cardsmobile-rs-api'), index.js loads _support.js, which reconstructs remote hosts via string-array join (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev) to hide the destinations from static analysis, downloads a platform-specific executable, writes it to /tmp or %TEMP% under a deceptive name such as dotnet_diag_<token>.exe, chmods it 0755, and detached-spawns it via child_process.spawn('/bin/sh') or spawn('cmd'). A DNS TXT-record fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru serves as an alternate transport. A TTL marker file (.analytics_state) gates the drop to fire once. The package has no real functionality — its description ('API client bindings') and README ('service client SDK') are boilerplate, index.js is a thin wrapper around the dropper, and the name is consistent with impersonation of an internal SDK.\n","affected":[{"package":{"ecosystem":"npm","name":"cardsmobile-rs-api"},"versions":["35.5.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"971aed3de8f4b7047c7bca3bc5836313e1e56e64fabc322c20ff5a611682f1dc","tlsh":"eeb1859a02a671198b70e7e4c7178826f55bf66337808180fb5ca5849f735248371efc"},{"path":"package.json","sha256":"0d5d0cb0b54e3a5afee35514052bca7f12fb75bc02f4e889d399cff283e4090a","tlsh":"25c080238650657304f446505c6181173a630f3f34759c07377b711c50b517219fc315"}],"package_integrity":[{"filename":"cardsmobile-rs-api-35.5.6.tgz","hashes":{"sha1":"3e1aa13aeb15290e489318e795d25b5a535f44e4","sha512_sri":"sha512-snCQpwSesZoicIWJBT0UkiHDPjW3GrnHOnVawqzATZdgBcvGA2bogC7aP3XnK4DztBeQMxeFCyCDCuj/TtBvFg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cardsmobile-rs-api/v/35.5.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015244","import_time":"2026-08-05T14:20:16.122362974Z","modified_time":"2026-08-05T14:17:49Z","sha256":"e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608","source":"amazon-inspector","versions":["35.5.6"]}]}}