Malicious code in csc-csc-core (npm)
The npm package csc-csc-core version 35.8.6 contains malicious code that, upon requiring the package, downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hostnames. This binary is saved under disguised filenames in temporary directories and executed detached from the main process. The package uses runtime assembly of command and control hostnames and sandbox evasion techniques such as cooldown markers and opt-out flags. The package's README falsely advertises it as a benign base framework module.
AI Analysis
Technical Summary
The csc-csc-core npm package version 35.8.6 includes malicious functionality where its index.js loads an _init.js script that downloads a platform-specific binary from obfuscated Cloudflare Workers domains and fallback DNS TXT records. The binary is saved to temporary directories with disguised names, permissioned to be executable, and launched detached from the main process. Hostnames for command and control are dynamically assembled at runtime to evade static detection. Sandbox evasion is implemented via a cooldown marker file and an opt-out flag. The package's documentation does not disclose this behavior, misleading users about its true nature.
Potential Impact
This malicious package can execute arbitrary code on the host system by downloading and running a hidden binary, potentially allowing attackers to maintain persistence, execute further payloads, or exfiltrate data. The obfuscation and sandbox evasion techniques increase the difficulty of detection and analysis.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately remove the affected version (=35.8.6) of the csc-csc-core package from their environments. Avoid using this package until a trusted, verified version is released. Monitor for any unexpected processes or binaries spawned from temporary directories that match the described behavior.
Malicious code in csc-csc-core (npm)
Description
The npm package csc-csc-core version 35.8.6 contains malicious code that, upon requiring the package, downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hostnames. This binary is saved under disguised filenames in temporary directories and executed detached from the main process. The package uses runtime assembly of command and control hostnames and sandbox evasion techniques such as cooldown markers and opt-out flags. The package's README falsely advertises it as a benign base framework module.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The csc-csc-core npm package version 35.8.6 includes malicious functionality where its index.js loads an _init.js script that downloads a platform-specific binary from obfuscated Cloudflare Workers domains and fallback DNS TXT records. The binary is saved to temporary directories with disguised names, permissioned to be executable, and launched detached from the main process. Hostnames for command and control are dynamically assembled at runtime to evade static detection. Sandbox evasion is implemented via a cooldown marker file and an opt-out flag. The package's documentation does not disclose this behavior, misleading users about its true nature.
Potential Impact
This malicious package can execute arbitrary code on the host system by downloading and running a hidden binary, potentially allowing attackers to maintain persistence, execute further payloads, or exfiltrate data. The obfuscation and sandbox evasion techniques increase the difficulty of detection and analysis.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately remove the affected version (=35.8.6) of the csc-csc-core package from their environments. Avoid using this package until a trusted, verified version is released. Monitor for any unexpected processes or binaries spawned from temporary directories that match the described behavior.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12667
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735735bf8831d53914217e
Added to database: 08/05/2026, 15:31:01 UTC
Last enriched: 08/05/2026, 16:20:39 UTC
Last updated: 09/07/2026, 22:13:23 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.