{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "clob.js",
              "sha256": "954728b16738a4b44696a599eecde211ece2ccfcc9eb47bfaf4ba5c3ab6715be",
              "tlsh": "7412857a9af2612139b3d58dab0b441a6417b4073109ec54fa5cb35e6fcf02cc5a16fe"
            },
            {
              "path": "README.md",
              "sha256": "c416cd0af88256407c36a0613f189ac4257221c7206d0324f7ef5563c66f1125",
              "tlsh": "fba1c0fe2c045a632ff1c9c67e0fad4fef19914c668e2d8874de9050632122969ec160"
            },
            {
              "path": "clob2.0.exe",
              "sha256": "300a7dea05c2a588757010ad314fa55cb8ef3acebaa284f58a5cd0fd39bce478",
              "tlsh": "e9168d43f68592e9c0aec074c25b5237e376fc894a20679b73985b212f66b601f5f39c"
            }
          ],
          "package_integrity": [
            {
              "filename": "clob-2.73.0.tgz",
              "hashes": {
                "sha1": "40d17c4e886bca64d773cea6d25672323313ebc4",
                "sha512_sri": "sha512-3RD7rZLwC2tq8XAJqH4cvvcfbDjA4vUXVFPl+rUdz6N5t0CRc/pzEX0ZpppstTezEFofVnaaGh4PTkvmkCOWYA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@devcarron/clob"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "2.73.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://safedep.io"
      ],
      "name": "SafeDep",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004635",
        "import_time": "2026-05-26T05:52:59.538162961Z",
        "modified_time": "2026-05-25T12:00:48Z",
        "sha256": "7a672e1412ca3d2af83bcf7772d7cf6b1803b8987a43e4a2abc359112f34aea1",
        "source": "amazon-inspector",
        "versions": [
          "2.73.0"
        ]
      }
    ]
  },
  "details": "A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executable from IPFS on `postinstall`. The dropper fetches the binary from IPFS CID `bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa` via multiple public gateways (Pinata, Cloudflare, ipfs.io), drops it to `%LOCALAPPDATA%`, registers Windows Registry persistence under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` using a hidden VBScript wrapper (window style 0, no taskbar entry), launches the payload immediately, and reports the victim\u0027s public IP address to a hardcoded C2 server via HTTP POST. macOS and Linux stubs are present but not yet configured. Developer artifacts bundled in `config/meta_data.json` leak the attacker\u0027s build path: `E:\\getting IP and check list\\clob-downloader\\`.\n\n`@devcarron/clob` is a scoped package identical in behavior to `clob.api` and likely published by the same actor as a distribution variant. It bundles `clob2.0.exe` (\u22484 MB) directly in the tarball and also fetches from IPFS. Its `postinstall` script runs `clob.js`, which drops the executable to `%LOCALAPPDATA%\\clob2.0.exe`. The C2 beacon transmits the victim\u0027s public IP to `http://45.8.22.112:2026/api/urls`.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7a672e1412ca3d2af83bcf7772d7cf6b1803b8987a43e4a2abc359112f34aea1)\n@devcarron/clob ships a malicious postinstall dropper. package.json declares `postinstall: node clob.js`, which on `npm install` downloads an opaque Windows executable (clob2.0.exe) from IPFS via gateways including violet-tricky-quelea-562.mypinata.cloud, cloudflare-ipfs.com, and gateway.pinata.cloud (CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa), writes it under %LOCALAPPDATA%, generates a VBS launcher, and registers HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to silently launch the binary via wscript.exe with windowsHide. Equivalent persistence is installed on macOS via ~/Library/LaunchAgents/com.clob.agent.plist + launchctl load, and on Linux via ~/.config/autostart/clob.desktop. clob.js then resolves the installer\u0027s public IP through api.ipify.org and POSTs it to the hardcoded bare-IP endpoint http://45.8.22.112:2026/api/urls over plain HTTP \u2014 an install-time beacon notifying the operator of each successful infection. The tarball additionally ships a 4 MB Windows PE clob2.0.exe at the root, and README.md is copied verbatim from @img/sharp-win32-x64 (`Prebuilt sharp for use with Windows x64`) to disguise the package\u0027s true purpose. None of these behaviors relate to any legitimate library function: no source code, no advertised API, no relation to libvips/sharp.\n",
  "id": "MAL-2026-4347",
  "modified": "2026-05-26T05:55:01Z",
  "published": "2026-05-25T12:00:48Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@devcarron/clob/v/2.73.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @devcarron/clob (npm)"
}