claims-enums

{"modified":"2026-08-05T14:04:23Z","published":"2026-08-05T14:04:23Z","schema_version":"1.7.4","id":"MAL-2026-12614","summary":"Malicious code in claims-enums (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e)\nOn require('claims-enums'), index.js loads _polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS-TXT chunked fallbacks resolved from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to /tmp or %TEMP% under cover-story filenames (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmod'd 0755, and detach-spawned via /bin/sh or cmd.exe. Hostnames, the child_process import, and fs.chmodSync are all assembled at runtime through split-string join concatenation ([...].join(\"\"), require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to defeat static analysis; the same obfuscation appears in the unreferenced sibling lib/telemetry.js. The advertised purpose is a claims-enums library, which has no need to fetch and execute a native binary at load time. A DISABLE_TELEMETRY environment check is present as cover framing.\n","affected":[{"package":{"ecosystem":"npm","name":"claims-enums"},"versions":["35.7.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"159c30a8cd98e7758f792b065d36dce94a78b08b178236c64b73ee9d7c83f578","tlsh":"80a1b99a02a570188f70ebe4c7179826f65af66337808284fb9c65945fb3654c3b2dfc"}],"package_integrity":[{"filename":"claims-enums-35.7.6.tgz","hashes":{"sha1":"d14cf3e45f40bd3ae45556cdcd2b5bfc75b13673","sha512_sri":"sha512-e4YVNzkW3FnS2cOCK9LetMU1sUtWuQyt2xqpm83jA2JtitNVaNa2NPMJvdJBMiOTGgailqW7QHXe2yrrZnXJ+w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-enums/v/35.7.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015152","import_time":"2026-08-05T14:20:07.4705247Z","modified_time":"2026-08-05T14:04:23Z","sha256":"b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e","source":"amazon-inspector","versions":["35.7.6"]}]}}