claims-use-visual-viewport-resizingnpm
Advisory published Updated
claims-use-visual-viewport-resizing is a confirmed malicious npm package (MAL-2026-12648) that executes malicious code on install (malicious version 35.2.8). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in claims-use-visual-viewport-resizing (npm)
What this malware does
On require, index.js loads helpers.js which auto-invokes start(). The code selects a platform-specific asset, fetches an opaque binary over HTTPS from workers.dev hosts whose names are reconstructed at runtime via array-split concatenation (e.g. "oob-worker.cf99-9b3.workers.dev"), with a DNS TXT-record fallback resolving via *.dl.wel1.ru subdomains that are similarly assembled from split fragments. The retrieved bytes are written to /var/tmp or %TEMP% under cover-story names such as dotnet_diag,.cache_, or.analytics_state, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", fp+" &"]) on POSIX or spawn("cmd", ["/c", "start /b..."]) on Windows. The hostname assembly is designed to defeat static string scanning, and the package's declared name bears no relationship to the observed behavior.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for claims-use-visual-viewport-resizing (version 35.2.8).
If you installed it — respond
Remove claims-use-visual-viewport-resizing from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If claims-use-visual-viewport-resizing was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks claims-use-visual-viewport-resizing-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.