Threat Intelligence Database

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5) On require(), _bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded *.workers.dev hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT-record fallback channel over *.dl.wel1.ru subdomains, writes it to /tmp or %TEMP% under a disguised name (.cache_<tag> / dotnet_diag_<tag>.exe), chmods 0755, and detached-spawns it via /bin/sh -c or cmd /c start (_bootstrap.js line 119, 121, 125). Destination hostnames are split across array joins to evade static string search, and a secondary loader reassembles a base64 payload from indexed DNS TXT records (count from c.<domain>, chunks from <i>.<domain>). Cover-story comments frame the behavior as analytics/telemetry. ## Source: ghsa-malware (9e7caf9639d9018e9b2d1b267b2ac9aa3910b7c1554c960ac992a948d435b7ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd) On require(), index.js loads _bootstrap.js, which reconstructs remote hosts by array.join string concatenation (oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev, with a *.dl.wel1.ru DNS-TXT fallback), downloads an opaque platform-specific binary over HTTPS (or via chunked base64 in DNS TXT records against c.<domain>/i.<domain> when HTTPS is unavailable), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached and unref'd with stdio ignored via /bin/sh -c or cmd /c start. The package presents itself as a trivial BNPL container wrapper and ships no code related to that stated purpose; the fetched bytes are neither pinned nor hash-verified, the destinations are obfuscated to defeat static inspection, the DNS-TXT channel is designed to bypass HTTPS egress filtering, and the on-disk filenames impersonate legitimate diagnostic/cache artifacts. ## Source: ghsa-malware (f7a9336e6ce709efb3da35d383cf42ce65c1e5e998722cb7afda94304416a4d6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42) On require of the package, index.js unconditionally loads _bootstrap.js, which downloads a platform-specific binary from hostnames assembled via split-string concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with fallbacks to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru and a DNS TXT-record base64-chunk retrieval channel. The downloaded binary is written to /tmp or %TEMP% under a decoy hidden filename (.cache_<uid>, dotnet_diag_<uid>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names are runtime-assembled ("child_"+"process", "chmod"+"Sync") to defeat static scanners. A second, larger implementation of the same drop-and-exec pattern is shipped as lib/telemetry.js under an 'analytics SDK' cover story. ## Source: ghsa-malware (00ac66bbc4c02b2579e227b39cd22b64e933989d8526b03c561886cd85d67abc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310) On require of the package, index.js unconditionally loads _bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked fallback that reassembles base64 content across numbered subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmod 0755 on POSIX, and executed detached via spawn("/bin/sh",...) or spawn("cmd",...). Destination hostnames are assembled from fragmented arrays joined at runtime to evade static analysis; the file is staged under masquerading names (dotnet_diag_,.cache_) and gated behind DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK cover-story environment variables. The package's advertised purpose (a picture-gallery / BNPL support module) has no legitimate need to download and execute a native binary from anonymous edge-worker hosts with no version pinning, no publisher-controlled origin, and no hash or signature verification. ## Source: ghsa-malware (93b7d20b5c9d5f24d8d4b343681dbe0e37ec95816667d008a60fe956e8714e66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package 'claims-format-money' version 35.5.5 contains malicious code that downloads and executes platform-specific binaries under deceptive filenames. The package's _bootstrap.js reconstructs download URLs at runtime, fetches unpinned binaries, writes them to temporary directories, sets executable permissions, and spawns them detached from the main process. This behavior is disguised as analytics telemetry, contradicting the package's stated purpose of money formatting. A similar dropper mechanism is implemented in lib/telemetry.js, using base64 chunk reassembly and DNS-based service discovery. This constitutes a supply-chain binary dropper masquerading as a formatting utility.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626) Requiring devplatform-auth-client loads `_bootstrap.js`, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded Cloudflare `workers.dev` subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-based fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes them to /tmp or %TEMP% under decoy names such as `.cache_<hex>` and `dotnet_diag_<hex>.exe`, chmods 0755, and spawns them detached via `/bin/sh -c` or `cmd`. The destination hostnames and dangerous API names are assembled from split-string fragments joined at runtime to evade static scanners. A sibling `lib/telemetry.js` module, presented as an analytics SDK, contains a parallel loader that base64-decodes a payload, dynamically resolves `chmodSync`, and spawns the decoded file. The fetched bytes are unpinned, unverified, and unrelated to any documented publisher. ## Source: ghsa-malware (84dec7cc75aa19ce40a478689c787d0a170d2f8f52aea764f4357e1b83e496a0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea) On require() of the package, index.js loads _bootstrap.js which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS-TXT fallback channel resolving *.dl.wel1.ru hosts (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under a randomized name such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe. Hostnames and dangerous API names (child_process, chmodSync) are reconstructed from split-string arrays via Array.join('') to evade static analysis. A secondary module lib/telemetry.js (81 KB) ships the same drop-and-execute primitives (base64 buffer decode, fs.chmodSync 0755, cp.spawn('/bin/sh', ['-c', filePath+' &'])) behind an 'analytics SDK' cover story. The package presents itself as a devplatform CLI lint plugin; the shipped code performs full-host remote code execution on library load. ## Source: ghsa-malware (ea105640a744e8157c32baaf4d5826923dbd99cafbdf4c5652d633368d0c85eb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9) The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes `try { require('./_bootstrap'); } catch (_) {}` on module load, hiding the malicious side effect behind a swallowed exception. _bootstrap.js selects a platform-specific payload path, downloads bytes from one of three hardcoded Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru — writes the payload to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd /c start`. Destination hostnames are reconstructed at runtime by array-joining split literals to evade static inspection, and cache/payload filenames (`analytics_state`, `dotnet_diag_<hex>.exe`) are chosen to blend in with legitimate telemetry artifacts. An 80KB lib/telemetry.js is shipped but never referenced from index.js, consistent with cover-story padding. Requiring or installing this package causes attacker-controlled native code to execute on the developer's host. ## Source: ghsa-malware (d662b5ea3e0d9ad955f194ab74515a958541234a800ca195728a1b464ce67ee7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a) Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires _bootstrap.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with hostnames reconstructed at runtime via array-join to evade literal detection, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh or cmd. If HTTPS mirrors fail, a DNS-TXT fallback channel queries c.<domain> at sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru for a chunk count and reassembles base64-encoded payload chunks from N.<domain> TXT records. A second file lib/telemetry.js contains an unreferenced variant of the same dropper. The Cloudflare Workers and wel1.ru destinations are unrelated to any legitimate Sentry infrastructure, and the package's advertised functionality is a cover story around the dropper. ## Source: ghsa-malware (f76cb55af9e854ca5d57e6b318ae84ac06c517b98e7628117cc949f69c5c84fc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (aa133d7d2ce61c2b2b4d2c48beec5e819a49b52349f7f0b212e446a667457ea7) On require() of the package, index.js loads _bootstrap.js, which selects a platform-specific payload (linux_x64, linux_arm64, darwin, win32), downloads it from Cloudflare Workers hosts whose names are reconstructed at runtime from split string fragments (e.g. oob-worker.cf100-416.workers.dev and sibling cf102-baf/cf103-070/cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names mimicking legitimate OS artifacts (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A marker file.analytics_state is dropped alongside. Host names and endpoints are split-string obfuscated to evade static analysis. Simply importing this package as a library causes remote code execution on the installer's machine with the installer's privileges. ## Source: ghsa-malware (baa705869682cdd4f94383db6e54ff0d9043537865aeb128a6c75697379322f0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.