cards-forms-clone-debit-clone @35.8.6
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12526
Ecosystem
npm
Summary
On require(), index.js loads _bootstrap.js which reconstructs endpoint hostnames from split string fragments (assembling *.workers.dev hosts such as oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf, with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary, writes it under a decoy filename ('dotnet_diag_<hex>.exe' on Windows, '.cache_<hex>' on POSIX) into /tmp or %TEMP%, chmods it 0755, and detach-spawns it via '/bin/sh -c <path> &' or 'cmd.exe /c start /b'. No hash or signature verification is performed and the fetch URLs are unpinned. Telemetry-style cover strings ('.analytics_state', DISABLE_TELEMETRY / DO_NOT_TRACK env-var gating) and host-string reassembly conceal the C2 destinations and the nature of the dropped executable.
Source: amazon-inspector (af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.