{"schema_version":"1.8.0","id":"MAL-2026-12539","published":"2026-08-05T14:17:12Z","modified":"2026-08-05T14:35:07.347854065Z","summary":"Malicious code in certificates-revocation-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837)\nOn module load, index.js requires _vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames (assembled via split-string concatenation such as ['oob-worker.','cf101-','adf.workers.','de','v'].join('')) with a DNS-TXT base64 chunked fallback resolved via *.dl.wel1.ru. The fetched bytes are written to a temp path with a randomized name, chmod 0755'd on POSIX, and executed via detached cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}) or cp.spawn('cmd.exe',['/c','start','/b',fp]). The download URL is not pinned, not hash-verified, and unrelated to the package's stated purpose (\"shared utilities\"). Additional obfuscation hides the child_process require and chmodSync call (require('child_'+'process'), fs['chmod'+'Sync']), and a /tmp/.analytics_state stamp gates single-execution-per-TTL. Requiring or installing this package causes arbitrary attacker-controlled code to execute on the installer's machine.\n","affected":[{"package":{"name":"certificates-revocation-utils","ecosystem":"npm","purl":"pkg:npm/certificates-revocation-utils"},"versions":["35.1.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"bfa1d033c4f346d215519cf17832e4c9a0ded9ba90ddafbaee12b7939909a2a2","tlsh":"25b1b79a16aa70194bb0dbe08b174416f65bf6633780c2d4fb9ca5985fb31248371efc"}],"package_integrity":[{"filename":"certificates-revocation-utils-35.1.9.tgz","hashes":{"sha1":"76737fa8ad944ccf1e6c24369080a7591fd72823","sha512_sri":"sha512-mbhAxqhqadhDgOG9sgHhMWtk3Y/4u4Fy4Cak/u/h6399KUo5ksTBKva3758Xet8K3fFNWlRh0MP3uqzDXx7Gng=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/certificates-revocation-utils/MAL-2026-12539.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/certificates-revocation-utils/v/35.1.9"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015240","import_time":"2026-08-05T14:20:15.790323807Z","modified_time":"2026-08-05T14:17:12Z","sha256":"4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837","source":"amazon-inspector","versions":["35.1.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}