claims-person-domain

{"modified":"2026-08-05T14:01:05Z","published":"2026-08-05T14:01:05Z","schema_version":"1.7.4","id":"MAL-2026-12636","summary":"Malicious code in claims-person-domain (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8)\nOn require of the package's main entry, index.js loads./_support.js which selects a platform-specific asset path (linux/darwin/win32), fetches an opaque binary from one of four Cloudflare Workers endpoints whose hostnames are assembled at runtime by joining fragmented string arrays (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), with a DNS-TXT covert-channel fallback via {sdk,ext,pkg,net}.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe. A persistence marker at /tmp/.analytics_state prevents re-execution. A parallel dropper implementation is bundled in lib/telemetry.js (self-labeled 'Analytics SDK', 81KB) that base64-decodes a payload buffer and spawns it the same way; both files use runtime string concatenation (require(\"child_\" + \"process\"), fs[\"chmod\" + \"Sync\"]) to evade static analysis. The obfuscation, disguised filenames mimicking diagnostic tooling, DNS-TXT fallback, and dual dropper implementations have no legitimate purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"claims-person-domain"},"versions":["35.5.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"f973b1831f83e3207e2f3def139b0ea3678f82aa6e78e8347d487afa68035dc4","tlsh":"02b1a75a16a630298bb0d7e48617441af66be6633781c2d8f75ca5881fb3524c3b2dfc"},{"path":"lib/telemetry.js","sha256":"271ad3b764eaa8ff31992e1dd5777388c85d59c6bf179c0db2b896cc9519086e","tlsh":"94835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"claims-person-domain-35.5.9.tgz","hashes":{"sha1":"acdd36c902eddeadf534af1b28a3ed883dcf17d9","sha512_sri":"sha512-Z8Y7YNg2Wzx/rCaZma1Aul5F/cIsdu85U3w5f9m6LV77PPCFc8HOcKO3QucNuTBgFZfQjH4WbRPmahnyfS7fwA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-person-domain/v/35.5.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015131","import_time":"2026-08-05T14:20:05.179451117Z","modified_time":"2026-08-05T14:01:05Z","sha256":"03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8","source":"amazon-inspector","versions":["35.5.9"]}]}}