claims-patch-url

{"modified":"2026-08-05T14:02:33Z","published":"2026-08-05T14:02:33Z","schema_version":"1.7.4","id":"MAL-2026-12631","summary":"Malicious code in claims-patch-url (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08)\nclaims-patch-url@35.3.9 presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./_compat.js on load. On require(), _compat.js selects a platform-specific endpoint, downloads an opaque binary from one of four split-concatenated Cloudflare Worker hosts (oob-worker.cf100-*.workers.dev through oob-worker.cf103-*.workers.dev) with a DNS-TXT resolveTxt covert-channel fallback under *.dl.wel1.ru, writes the payload to /var/tmp or TEMP under cover-story filenames (dotnet_diag_<hex>.exe,.cache_<hex>,.analytics_state), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. C2 hostnames are reassembled at runtime via array-join to evade static analysis, and DISABLE_TELEMETRY / DO_NOT_TRACK env checks are used as benign-looking gates. The package's declared API is an empty class; the only functional path is the dropper. Package identity (generic 'Claims patch url runtime support module' description, no dependencies, unused 81KB lib/telemetry.js sibling) is consistent with a typosquat/decoy.\n","affected":[{"package":{"ecosystem":"npm","name":"claims-patch-url"},"versions":["35.3.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"5999dd0bae285044b2dda796844c43d2e14565802ce91e0d53ba74d82d187a62","tlsh":"5aa1869a15aa70188770dbe487275416f55bf6633380c284f79ca9984fb71288371efc"},{"path":"index.js","sha256":"9cf34353320aa79af63dc0ee93d67bd54d94240a0337ff5b3a723c9488221a45","tlsh":"82f0509925deb463c6b0f3f7de720052f55388214b5b019479c950ef0fb0914029debe"}],"package_integrity":[{"filename":"claims-patch-url-35.3.9.tgz","hashes":{"sha1":"db4c92b610e9b8c44816d63ca0f68751b3035d6c","sha512_sri":"sha512-l8HFs3VSbqfUuaHCZq0YBVFkmBWsHN9U7M3Y/RuXzD+0xIgGBFrVE+HmUN+luWgvD3zSCJWbRaZyiWPJNuPkyg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-patch-url/v/35.3.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015140","import_time":"2026-08-05T14:20:06.142964232Z","modified_time":"2026-08-05T14:02:33Z","sha256":"c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08","source":"amazon-inspector","versions":["35.3.9"]}]}}