{"answers":{"affected":"1 open source package ship an affected version, including claims-block-visibility.","exploited":"There is no known exploitation of MAL-2026-12609 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12609 is a malicious package in claims-block-visibility, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12609 is a malicious package: claims-block-visibility (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12609/ (Markdown: https://insights.sbomify.com/MAL-2026-12609/index.md)","id":"MAL-2026-12609","markdown":"https://insights.sbomify.com/MAL-2026-12609/index.md","name":"MAL-2026-12609","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require('claims-block-visibility'), index.js loads _polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint, downloads a binary from one of several string-concatenation-obfuscated hosts under *.workers.dev, and falls back to a chunked base64-over-DNS-TXT channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru when HTTPS is unavailable. The fetched bytes are written to a temp path disguised as.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe with unref(). Destination hostnames are assembled from split string arrays (e.g. ['oob','-worker','.cf103-',...].join('')) and require('child_process') is masked as require('child_'+'process'). A cache-stamp file is written under a benign '.analytics_state' name. The behavior fires on module load, giving any consumer that requires this package a fetch-and-execute of opaque attacker-controlled native code.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in claims-block-visibility (npm)","id":"MAL-2026-12609","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"claims-block-visibility","purl":"pkg:npm/claims-block-visibility","source":"MAL-2026-12609"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12609/"}