docsmate-docsmate-core

{"modified":"2026-08-05T15:29:07Z","published":"2026-08-05T15:29:07Z","schema_version":"1.7.4","id":"MAL-2026-13281","summary":"Malicious code in docsmate-docsmate-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e)\nOn require(), index.js loads _support.js which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf, cf102-baf) from split string fragments, with a DNS-TXT fallback resolver chain across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. It downloads an OS/arch-specific binary over HTTPS, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods 0755, and detaches it via spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or spawn('cmd',...). A stamp file suppresses re-runs and environment variables can disable execution. The package presents itself as a platform/core types library and ships no shipped native source that would justify fetching and executing an opaque binary at import time. Destination hosts are string-obfuscated to evade static inspection, and the dropped file is named to impersonate a Microsoft.NET diagnostic tool.\n","affected":[{"package":{"ecosystem":"npm","name":"docsmate-docsmate-core"},"versions":["35.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"40c79432762782f32d31c3a7c1cdc71370eeea0d06630e40427cf8c1e9b79532","tlsh":"31a1975b156a70188b709bf0c7174816f65bf6633380c584fb9ca9985f7252483b2efc"}],"package_integrity":[{"filename":"docsmate-docsmate-core-35.9.3.tgz","hashes":{"sha1":"bbdfe1d9920eb283384ebf25518e9c7d2441c4c2","sha512_sri":"sha512-zbDUxWJfGHYoYJtjfGrxUtCGiE2AN2HjX1oSCesdHFdEdoZTFyi4Y0vjUDGSsj7ch0om/0BZaKiDlwC9BtqFkg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/docsmate-docsmate-core/v/35.9.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015716","import_time":"2026-08-05T16:13:35.530544701Z","modified_time":"2026-08-05T15:29:07Z","sha256":"9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e","source":"amazon-inspector","versions":["35.9.3"]}]}}