MAL-2026-12546
Dashboard / Malicious Package / MAL-2026-12546
MAL-2026-12546
Summary: Malicious code in checkout-cashback-logic (npm)
Details: Source: amazon-inspector (493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3) [email protected] silently requires _bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) from split string arrays, with a DNS TXT chunked fallback channel using *.dl.wel1.ru subdomains reconstructed the same way. It downloads a platform-specific native executable, writes it to /tmp under hidden or misleading names (a dotfile such as.cache_<hex>/.analytics_state on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. There is no integrity check on the fetched binary, the destinations are unrelated to the package's stated logging/cashback purpose, and the string-splitting reconstruction of the hosts is deliberate evasion of static analysis. Any require() of this package results in an opaque attacker-controlled binary running on the installer's host.
Affected packages
Package
Name: checkout-cashback-logic
Purl: pkg:npm/checkout-cashback-logic
Affected ranges
Type: N/A
Events:
