MAL-2026-12541
Dashboard / Malicious Package / MAL-2026-12541
MAL-2026-12541
Summary: Malicious code in checkout-accounts-holder (npm)
Details: Source: amazon-inspector (cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a) On `require('checkout-accounts-holder')`, index.js loads _platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames assembled at runtime via `.join("")` over split string fragments (resolving to `oob-worker.cf100-416.workers.dev` with a DNS TXT fallback under `sdk.dl.wel1.ru`), writes the opaque payload to /tmp or %TEMP% under cover names such as `.cache_<rand>` and `dotnet_diag_<rand>.exe`, chmods it 0o755, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd.exe /c start`. The module presents itself as `analytics_state`/telemetry. A second dropper of the same shape ships in lib/telemetry.js (base64-chunked payload, `fs["chmod"+"Sync"]`, `require("child_"+"process")`, `spawn("/bin/sh", ["-c", filePath + " &"])`), currently unreferenced but present in the published tarball. Destination hostnames are string-split to evade plain-text scanners, and the run-write-chmod-spawn chain executes attacker-controlled bytes with the installer's privileges.
Affected packages
Package
Name: checkout-accounts-holder
Purl: pkg:npm/checkout-accounts-holder
Affected ranges
Type: N/A
Events:
