MalwarePublished 5 Aug 2026

claims-page-maker-types (npm) · Malicious Code

Affects claims-page-maker-typesSource GCVE Database

Malicious package : remove claims-page-maker-types and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:14 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12630

What to do

Remove claims-page-maker-types from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-page-maker-types	Affected =35.5.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package claims-page-maker-types version 35.5.1 contains malicious code that, upon requiring the package, loads a module which fetches and executes a platform-specific binary from hardcoded external Cloudflare worker domains and a fallback DNS TXT record. The binary is saved to a disguised temporary path, given executable permissions, and spawned detached from the main process. The code attempts to evade detection by assembling host strings from fragments and mimicking system diagnostic filenames. There is no integrity verification of the downloaded payload, and the external hosts are unrelated to the package publisher. Execution is throttled by a local stamp file to limit repeated runs.

Impact

This malicious code enables remote code execution on the host system where the package is installed, by downloading and running an arbitrary binary from attacker-controlled infrastructure. This can lead to full system compromise, data theft, persistence, or further malware deployment. The lack of payload verification and use of external hosts increases the risk of undetected exploitation. The disguised filenames and throttling mechanism suggest attempts to evade detection and maintain stealth.

Defensive guidance

Users should immediately remove this package version from their projects and replace it with a trusted alternative or a version verified to be clean once available. Avoid installing or requiring this package until vendor or registry advisories confirm remediation. Monitor for any unusual execution of binaries named similarly to system diagnostics and network connections to the specified Cloudflare workers.dev domains and wel1.ru.

Summary

The malicious behavior in claims-page-maker-types@35.5.1 is triggered during module load. The _adapter.js script fetches an opaque binary payload over HTTPS from one of four hardcoded Cloudflare workers.dev domains or a DNS TXT fallback under wel1.ru. The payload is saved to a disguised temporary file (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable, and it is executed detached via shell commands. Host strings are obfuscated by joining split fragments to evade static detection. The binary execution is limited by a local 'analytics_state' stamp file. No cryptographic signature or pinning is used to verify the payload, and the external hosts are not affiliated with the package registry or publisher infrastructure, indicating a supply chain compromise or malicious package insertion.

References

npmjs.com/package/claims-page-maker-types/v/35.5.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:14 UTC

Technical details

References

Community reviews