constructor-blocks-mailings

{"modified":"2026-08-05T13:58:20Z","published":"2026-08-05T13:58:20Z","schema_version":"1.7.4","id":"MAL-2026-12662","summary":"Malicious code in constructor-blocks-mailings (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5124a2b9217dc772621cdedf3938c8ed063ede4daa0fdd82c2e11b9df85403fb)\nOn require() of the package, index.js loads _adapter.js which selects a platform-specific endpoint, downloads an opaque binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback channel via numbered subdomains under *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe, analytics_state), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. Destination hostnames are assembled from split string fragments (e.g. \"oob-worker.c\"+\"f100-416.workers.dev\") to evade static analysis. The fetched bytes are opaque with no hash or signature verification. The combination of load-time execution, obfuscated rotated C2, DNS-TXT covert delivery channel, cover-story file naming, and unverified binary execution matches a hostile install/load-time dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"constructor-blocks-mailings"},"versions":["35.5.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"cead6f8f90bfbf1df0ea8ae189951f8f6d160623b5e4868520087bd9918850d3","tlsh":"a7a1739a166a701c4bb0ebf496174415f65ae6633681c288fa5c68981fb35248372efc"}],"package_integrity":[{"filename":"constructor-blocks-mailings-35.5.7.tgz","hashes":{"sha1":"13f90bb165b8b4c2e3660578c7c7d4827dd3ad22","sha512_sri":"sha512-ZGpz0frb+wy/EIqAZuqEk2808mU/GPhHfzTd7bskt507kuhhzzU7HAUg0MXb2kK63yuD5vPC9H0KItcaCJVoog=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/constructor-blocks-mailings/v/35.5.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015113","import_time":"2026-08-05T14:20:03.392939552Z","modified_time":"2026-08-05T13:58:20Z","sha256":"5124a2b9217dc772621cdedf3938c8ed063ede4daa0fdd82c2e11b9df85403fb","source":"amazon-inspector","versions":["35.5.7"]}]}}