MAL-2026-12548
Dashboard / Malicious Package / MAL-2026-12548
MAL-2026-12548
Summary: Malicious code in checkout-commit-pos-order-am (npm)
Details: Source: amazon-inspector (732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8) [email protected] executes a dropper on module load. Its main entry `index.js` requires `_shim.js`, which selects a platform-specific asset path and downloads an opaque native binary over HTTPS from hardcoded `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf99-9b3.workers.dev`, and `oob-worker.cf103-070.workers.dev` hosts, with a DNS TXT-record fallback that reassembles base64 chunks from `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, and `net.dl.wel1.ru`. Destination hostnames and the `child_process` require are built at runtime by joining fragmented substrings to evade static scanners. The downloaded bytes are written to `/var/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows (disguised filenames), chmod 0755, and spawned detached via `/bin/sh -c "<path> &"` or `cmd.exe /c start /b`. A parallel dropper with the same download-chmod-spawn shape is bundled as `lib/telemetry.js` (~81KB) under an analytics-SDK cover story and is not currently wired from the entry points but ships in the tarball.
Affected packages
Package
Name: checkout-commit-pos-order-am
Purl: pkg:npm/checkout-commit-pos-order-am
Affected ranges
Type: N/A
Events:
