MAL-2026-12535 Malicious code in cardsmobile-rs-api (npm)
Malicious package
Published
MAL-2026-12535 is a malicious package: cardsmobile-rs-api (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12535/ (Markdown: https://insights.sbomify.com/MAL-2026-12535/index.md)
- Package
- cardsmobile-rs-api
- Registry
- npm
What is MAL-2026-12535?
MAL-2026-12535 is a malicious package in cardsmobile-rs-api, published on 5 Aug 2026.
Official description
On require('cardsmobile-rs-api'), index.js loads support.js, which reconstructs remote hosts via string-array join (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev) to hide the destinations from static analysis, downloads a platform-specific executable, writes it to /tmp or %TEMP% under a deceptive name such as dotnet_diag<token>.exe, chmods it 0755, and detached-spawns it via child_process.spawn('/bin/sh') or spawn('cmd'). A DNS TXT-record fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru serves as an alternate transport. A TTL marker file (.analytics_state) gates the drop to fire once. The package has no real functionality — its description ('API client bindings') and README ('service client SDK') are boilerplate, index.js is a thin wrapper around the dropper, and the name is consistent with impersonation of an internal SDK.
What should I do about MAL-2026-12535?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.