MAL-2026-12629 Malicious code in claims-navigate (npm)
Malicious package
Published
MAL-2026-12629 is a malicious package: claims-navigate (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12629/ (Markdown: https://insights.sbomify.com/MAL-2026-12629/index.md)
- Package
- claims-navigate
- Registry
- npm
What is MAL-2026-12629?
MAL-2026-12629 is a malicious package in claims-navigate, published on 5 Aug 2026.
Official description
On require() of the package, index.js loads adapter.js which downloads an opaque binary from author-controlled Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temp path with disguised filenames (dotnet_diag<hex>.exe,.cache_<hex>) under /var/tmp or %TEMP%, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. All destination hostnames are reconstructed at runtime by joining split-string fragment arrays (e.g. ['oob-wo','rker.','cf101-adf.wo','rkers.','dev'].join('')) to defeat static string matching. If HTTPS retrieval fails, _adapter.js falls back to a DNS-TXT covert channel: it queries c.<domain> for a chunk count, batches TXT lookups against N.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (also fragment-assembled), base64-decodes the concatenated TXT records into a binary, writes it to disk, and spawns it detached. Fetched bytes are opaque with no hash or signature verification. Environment variables named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are present as an 'analytics' cover story; the README does not disclose any binary download.
What should I do about MAL-2026-12629?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.