claims-use-base-analytics

{"modified":"2026-08-05T13:59:46Z","published":"2026-08-05T13:59:46Z","schema_version":"1.7.4","id":"MAL-2026-12646","summary":"Malicious code in claims-use-base-analytics (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f191811e6841cbfe4cc2c9621f7876290b92efc2bdc78e9c4f6c4cca7933c0f)\nclaims-use-base-analytics@35.4.9 is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads _shim.js which selects a platform-specific asset path and fetches an opaque binary via HTTPS from one of three attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The binary is written to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_<rnd>.exe on Windows,.cache_<rnd> on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. If the HTTPS fetch fails, loadViaDns() reassembles a base64-encoded payload from TXT records under per-platform subdomains of dl.wel1.ru (sdk., ext., pkg., net.) — a DNS-over-TXT covert channel designed to bypass HTTP egress filtering — then writes, chmods, and executes the resulting bytes. C2 hostnames are string-split-obfuscated (e.g. [\"oob-worker.cf100-416.w\",\"orke\",\"rs\",\".dev\"].join(\"\")) and require(\"child_\" + \"process\") is used to evade static analysis. Execution is gated by a ~6h TTL cache stamp in.analytics_state so it fires at most once per interval, and DISABLE_TELEMETRY / DO_NOT_TRACK env vars are honored as cover for an ostensibly benign analytics stub. The package's advertised purpose (analytics wrapper) has no legitimate need for a native-binary dropper, a covert DNS-TXT fallback, or hostname obfuscation.\n","affected":[{"package":{"ecosystem":"npm","name":"claims-use-base-analytics"},"versions":["35.4.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"98f42b81ae02d895df3375c9379bb0f446284296ba430627a9cf905566392b48","tlsh":"e9a185aa15a6701847b0dbe4c6176415f65bf6633780c1d8fb9ca5d80fb326482b2efc"}],"package_integrity":[{"filename":"claims-use-base-analytics-35.4.9.tgz","hashes":{"sha1":"f5ac20435f8ca5bc5719db01e95933b3c1e6b47b","sha512_sri":"sha512-R7Ke3XNnDl8GZpt1/p5E/sxe9NRoV+/l5kGT79ZEXLAr1D/3nyge0VE0B6CthaI2tmgZiaYKMZFG0hQNBFkIDQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-use-base-analytics/v/35.4.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015122","import_time":"2026-08-05T14:20:04.355822731Z","modified_time":"2026-08-05T13:59:46Z","sha256":"0f191811e6841cbfe4cc2c9621f7876290b92efc2bdc78e9c4f6c4cca7933c0f","source":"amazon-inspector","versions":["35.4.9"]}]}}