🛡️ MAL-2026-12648 — claims-use-visual-viewport-resizing

Malicious code in claims-use-visual-viewport-resizing (npm)

Source: amazon-inspector

On require, index.js loads _helpers.js which auto-invokes start(). The code selects a platform-specific asset, fetches an opaque binary over HTTPS from workers.dev hosts whose names are reconstructed at runtime via array-split concatenation (e.g. "oob-worker.cf99-9b3.workers.dev"), with a DNS TXT-record fallback resolving via *.dl.wel1.ru subdomains that are similarly assembled from split fragments. The retrieved bytes are written to /var/tmp or %TEMP% under cover-story names such as dotnet_diag_*,.cache_*, or.analytics_state, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", fp+" &"]) on POSIX or spawn("cmd", ["/c", "start /b..."]) on Windows. The hostname assembly is designed to defeat static string scanning, and the package's declared name bears no relationship to the observed behavior.