MAL-2026-12544
Dashboard / Malicious Package / MAL-2026-12544
MAL-2026-12544
Summary: Malicious code in checkout-base-test (npm)
Details: Source: amazon-inspector (3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2) On require() of this package, index.js loads _helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split string fragments joined at runtime (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), selects a platform-specific endpoint, fetches an opaque binary via https.get, writes it to /var/tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh", ["-c",...]) or spawn("cmd",...). A DNS-TXT chunked base64 covert-channel fallback contacts *.dl.wel1.ru when the HTTPS hosts are unreachable. Additional evasion: require("child_" + "process") string concatenation in lib/telemetry.js, environment-variable gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, and a filesystem session stamp to fire once per host. The disguised filenames (dotnet_diag_,.cache_) impersonate legitimate diagnostic artifacts. The package name resembles a checkout/test utility but ships no functionality matching that purpose.
Affected packages
Package
Name: checkout-base-test
Purl: pkg:npm/checkout-base-test
Affected ranges
Type: N/A
Events:
