{"answers":{"affected":"1 open source package ship an affected version, including claims-use-base-analytics.","exploited":"There is no known exploitation of MAL-2026-12646 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12646 is a malicious package in claims-use-base-analytics, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12646 is a malicious package: claims-use-base-analytics (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12646/ (Markdown: https://insights.sbomify.com/MAL-2026-12646/index.md)","id":"MAL-2026-12646","markdown":"https://insights.sbomify.com/MAL-2026-12646/index.md","name":"MAL-2026-12646","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"claims-use-base-analytics@35.4.9 is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads _shim.js which selects a platform-specific asset path and fetches an opaque binary via HTTPS from one of three attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The binary is written to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_\u003crnd\u003e.exe on Windows,.cache_\u003crnd\u003e on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. If the HTTPS fetch fails, loadViaDns() reassembles a base64-encoded payload from TXT records under per-platform subdomains of dl.wel1.ru (sdk., ext., pkg., net.) — a DNS-over-TXT covert channel designed to bypass HTTP egress filtering — then writes, chmods, and executes the resulting bytes. C2 hostnames are string-split-obfuscated (e.g. [\"oob-worker.cf100-416.w\",\"orke\",\"rs\",\".dev\"].join(\"\")) and require(\"child_\" + \"process\") is used to evade static analysis. Execution is gated by a ~6h TTL cache stamp in.analytics_state so it fires at most once per interval, and DISABLE_TELEMETRY / DO_NOT_TRACK env vars are honored as cover for an ostensibly benign analytics stub. The package's advertised purpose (analytics wrapper) has no legitimate need for a native-binary dropper, a covert DNS-TXT fallback, or hostname obfuscation.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in claims-use-base-analytics (npm)","id":"MAL-2026-12646","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"claims-use-base-analytics","purl":"pkg:npm/claims-use-base-analytics","source":"MAL-2026-12646"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12646/"}