# MAL-2026-4350: Malicious code in clobprice.api (npm)


- **Type:** Malicious package
- **Package:** `clobprice.api` (npm)
- **Published:** 25 May 2026

## What is MAL-2026-4350?

MAL-2026-4350 is a malicious package in clobprice.api, published on 25 May 2026. 

### Official description

A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executable from IPFS on `postinstall`. The dropper fetches the binary from IPFS CID `bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa` via multiple public gateways (Pinata, Cloudflare, ipfs.io), drops it to `%LOCALAPPDATA%`, registers Windows Registry persistence under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` using a hidden VBScript wrapper (window style 0, no taskbar entry), launches the payload immediately, and reports the victim's public IP address to a hardcoded C2 server via HTTP POST. macOS and Linux stubs are present but not yet configured. Developer artifacts bundled in `config/meta_data.json` leak the attacker's build path: `E:\getting IP and check list\clob-downloader\`.

`clobprice.api` bundles `windows defender host.exe` (≈4 MB) directly in the package tarball and also attempts to fetch an identical copy from IPFS at install time. Its `postinstall` script runs `clob.js`, which drops the executable to `%LOCALAPPDATA%\windows defender host.exe`. The C2 beacon transmits the victim's public IP to `http://45.8.22.112:2026/api/urls`.

package.json declares `postinstall: node clob.js` and the package's own description states 'Downloads clob2.0.exe on install'. On install, clob.js downloads a Windows PE from anonymous IPFS gateways (violet-tricky-quelea-562.mypinata.cloud, cloudflare-ipfs.com, gateway.pinata.cloud, ipfs.io; CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa) without any hash or signature verification, writes it to %LOCALAPPDATA% as 'windows defender host.exe' to impersonate a Microsoft component, and silently launches it hidden via a VBS launcher invoked through `wscript //nologo` with window style 0. A 4,035,072-byte file literally named 'windows defender host.exe' (sha256 300a7dea05c2a588757010ad314fa55cb8ef3acebaa284f58a5cd0fd39bce478) is also bundled in the tarball root as a fallback payload. Persistence is established on every supported platform: Windows registers the launcher under HKCU\Software\Microsoft\Windows\CurrentVersion\Run as 'clob'; macOS loads `~/Library/LaunchAgents/com.clob.agent.plist` via launchctl; Linux writes `~/.config/autostart/clob.desktop`. After dropping the binary, the script resolves the installer's public IP via api.ipify.org and POSTs it over plain HTTP to the hardcoded bare IP 45.8.22.112:2026 at `/api/urls?url=<ip>:80`, performing victim check-in to the operator. The result is full, persistent host compromise of any machine that runs `npm install clobprice.api`.

## What should I do about MAL-2026-4350?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4350 is a malicious package: clobprice.api (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4350/ (Markdown: https://insights.sbomify.com/MAL-2026-4350/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4350

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4350/
Summaries are generated and may contain mistakes; the official description above is the record.