{"answers":{"affected":"1 open source package ship an affected version, including caen-caen-core.","exploited":"There is no known exploitation of MAL-2026-12520 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12520 is a malicious package in caen-caen-core, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12520 is a malicious package: caen-caen-core (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12520/ (Markdown: https://insights.sbomify.com/MAL-2026-12520/index.md)","id":"MAL-2026-12520","markdown":"https://insights.sbomify.com/MAL-2026-12520/index.md","name":"MAL-2026-12520","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package's main entry (index.js) loads _ext.js on require. _ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS-TXT base64 fallback resolving via {sdk,ext,pkg,net}.dl.wel1.ru, writes it to /tmp or %TEMP% under deceptive names (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Hostnames are reconstructed at runtime by Array.join over split string fragments to evade static analysis, and the module presents an 'analytics'/telemetry cover story with DISABLE_TELEMETRY-style env gates. A secondary dropper in lib/telemetry.js contains the same shape with additional obfuscation: require(\"child_\" + \"process\"), Buffer.from(chunks, \"base64\"), fs[\"chmod\"+\"Sync\"], and cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" \u0026\"]). The fetched destinations and delivered binaries are unrelated to the stated 'platform core' purpose, giving whoever controls the C2 arbitrary code execution on any machine that installs or requires this package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in caen-caen-core (npm)","id":"MAL-2026-12520","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"caen-caen-core","purl":"pkg:npm/caen-caen-core","source":"MAL-2026-12520"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12520/"}