MAL-2026-12524 Malicious code in cards-forms-clone-cards-core-clone (npm)
Malicious package
Published
MAL-2026-12524 is a malicious package: cards-forms-clone-cards-core-clone (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12524/ (Markdown: https://insights.sbomify.com/MAL-2026-12524/index.md)
- Package
- cards-forms-clone-cards-core-clone
- Registry
- npm
What is MAL-2026-12524?
MAL-2026-12524 is a malicious package in cards-forms-clone-cards-core-clone, published on 5 Aug 2026.
Official description
On require(), index.js loads platform.js, which selects a platform-specific asset URL from obfuscated hostnames assembled via split-then-join string fragments (oob-worker.cf102-baf.workers.dev, cf103-070, cf99-9b3, cf100-416 workers.dev hosts, plus a DNS-TXT chunked fallback to *.dl.wel1.ru), downloads the payload, writes it to a hidden temp file, chmods it 0755 (or names it dotnet_diag*.exe on Windows), and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A stamp file named.analytics_state and env gates DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK provide a telemetry cover story; the package's advertised purpose is a base framework module unrelated to any such behavior. String-fragment obfuscation of the destination hosts and the masquerading filenames are deliberate evasion.
What should I do about MAL-2026-12524?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.