claims-use-callback-once

{"modified":"2026-08-05T13:59:54Z","published":"2026-08-05T13:59:54Z","schema_version":"1.7.4","id":"MAL-2026-12647","summary":"Malicious code in claims-use-callback-once (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1)\nOn require() of claims-use-callback-once, index.js unconditionally loads _shim.js which selects a platform-specific payload path, fetches an executable from one of several hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback over *.dl.wel1.ru (ext./pkg./net.dl.wel1.ru), writes the payload to /tmp or %TEMP% under a deceptive Microsoft-diagnostics-style name (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. Host strings and sensitive Node API names (child_process, chmodSync) are assembled at runtime via array joins and string concatenation to evade static analysis. lib/telemetry.js bundles a parallel dropper implementation (DNS TXT base64 payload assembly, chmod 0755, detached shell spawn) presented as an 'Analytics SDK' cover story. The package name resembles a callback utility but the shipped code has no such functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"claims-use-callback-once"},"versions":["35.6.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"de71b21bc14dda5135f5505fc5e68286e301023adb1e2fd94432580160b7d1f5","tlsh":"40a1859a16a570188bb0ebf487175415f65bf6633780c2d4fbac69941fb312482b2efc"},{"path":"lib/telemetry.js","sha256":"3931f7780ca9bc8d3a45466b1dc007ef3a4881f893f1f0dbb9d69b3b20928287","tlsh":"f0835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"claims-use-callback-once-35.6.7.tgz","hashes":{"sha1":"1134c177ecb282d05bdb2dc632703b2062d1ff1e","sha512_sri":"sha512-KOFXkErpzXIXp78S9JAhHE+b7WaN8MA8c/KYyusyVGyjTTA6BIs+1DPOGfJPBtaErdbsIq0f/P299stdbzafIg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claims-use-callback-once/v/35.6.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015123","import_time":"2026-08-05T14:20:04.447299762Z","modified_time":"2026-08-05T13:59:54Z","sha256":"0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1","source":"amazon-inspector","versions":["35.6.7"]}]}}