MAL-2026-12648 Malicious code in claims-use-visual-viewport-resizing (npm)
Malicious package
Published
MAL-2026-12648 is a malicious package: claims-use-visual-viewport-resizing (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12648/ (Markdown: https://insights.sbomify.com/MAL-2026-12648/index.md)
- Package
- claims-use-visual-viewport-resizing
- Registry
- npm
What is MAL-2026-12648?
MAL-2026-12648 is a malicious package in claims-use-visual-viewport-resizing, published on 5 Aug 2026.
Official description
On require, index.js loads helpers.js which auto-invokes start(). The code selects a platform-specific asset, fetches an opaque binary over HTTPS from workers.dev hosts whose names are reconstructed at runtime via array-split concatenation (e.g. "oob-worker.cf99-9b3.workers.dev"), with a DNS TXT-record fallback resolving via *.dl.wel1.ru subdomains that are similarly assembled from split fragments. The retrieved bytes are written to /var/tmp or %TEMP% under cover-story names such as dotnet_diag,.cache_, or.analytics_state, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", fp+" &"]) on POSIX or spawn("cmd", ["/c", "start /b…"]) on Windows. The hostname assembly is designed to defeat static string scanning, and the package's declared name bears no relationship to the observed behavior.
What should I do about MAL-2026-12648?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.