claims-format-money

{"modified":"2026-08-05T14:05:16Z","published":"2026-08-05T14:05:16Z","schema_version":"1.7.4","id":"MAL-2026-12618","summary":"Malicious code in claims-format-money (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009)\nThe package's index.js requires _bootstrap.js on import. _bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments (assembling oob-worker.cf*-*.workers.dev hosts with DNS TXT fallback to *.wel1.ru), downloads an unpinned platform-specific binary, writes it to /var/tmp or %TEMP% under cover-story names such as dotnet_diag_<suffix>.exe and.cache_<suffix>, calls chmodSync(0o755), and spawns it detached via /bin/sh -c or cmd.exe with.unref(). A marker file.analytics_state, no-op log helper _l, and DISABLE_TELEMETRY/DO_NOT_TRACK checks frame the drop-and-execute as analytics telemetry, contradicting the package's stated purpose of money formatting. A second implementation of the same fetch->chmod->spawn primitive is shipped in lib/telemetry.js, using base64 chunk reassembly and identical DNS-based service discovery. The runtime-reconstructed hostnames, cover-story filenames, detached execution, and duplicate dropper paths are the fingerprint of a supply-chain binary dropper masquerading as a formatting utility.\n","affected":[{"package":{"ecosystem":"npm","name":"claims-format-money"},"versions":["35.5.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"c8e0277f3d44f40b7a9b5073282722e4b5da795618a2231fd15500dc18001079","tlsh":"b6a1a85a15a67008c7b09bf48b17581af69bf6733780c298f75c69985f7242483b2efc"},{"path":"lib/telemetry.js","sha256":"c53c8fc7714def7eec0e25ed0235ab5cf1748bb64965d4f82d13689dffc444df","tlsh":"57835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"claims-format-money-35.5.5.tgz","hashes":{"sha1":"4ad329b13b1b44ef406b132c530a383fad7ea7f0","sha512_sri":"sha512-wUYRVs7HHqjPBITovdo6G0y1D72QGwpoP70APgGKS9+j3XcrFpm9sS5rclTBsTtayh6dO1NJdvnSNjverEVlug=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-format-money/v/35.5.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015158","import_time":"2026-08-05T14:20:07.991072371Z","modified_time":"2026-08-05T14:05:16Z","sha256":"bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009","source":"amazon-inspector","versions":["35.5.5"]}]}}