{"answers":{"affected":"1 open source package ship an affected version, including claims-should-retry.","exploited":"There is no known exploitation of MAL-2026-12643 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12643 is a malicious package in claims-should-retry, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12643 is a malicious package: claims-should-retry (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12643/ (Markdown: https://insights.sbomify.com/MAL-2026-12643/index.md)","id":"MAL-2026-12643","markdown":"https://insights.sbomify.com/MAL-2026-12643/index.md","name":"MAL-2026-12643","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require of the package, index.js loads _platform.js, which reconstructs destination hosts from split string arrays (e.g. Cloudflare Workers subdomains under oob-worker.cf*-*.workers.dev) via.join(\"\") to hide them from static inspection, downloads a platform-specific binary, writes it to /tmp or %TEMP% under a misleading name (dotnet_diag_*.exe or.cache_*), chmods it 0755, and spawns it detached with stdio ignored via child_process spawn against /bin/sh or cmd. If HTTP fetch fails, a DNS-TXT covert-channel fallback enumerates numbered TXT records under reconstructed *.dl.wel1.ru subdomains, base64-decodes and concatenates them into an executable buffer that is written and executed the same way. A.analytics_state / analytics_state marker file suppresses re-execution, opt-out environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide a telemetry cover story, and a no-op logger overwrites console output to suppress traces. The package is advertised as a claims-retry library and has no relation to fetching or executing platform binaries.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in claims-should-retry (npm)","id":"MAL-2026-12643","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"claims-should-retry","purl":"pkg:npm/claims-should-retry","source":"MAL-2026-12643"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12643/"}