MAL-2026-12549
Dashboard / Malicious Package / MAL-2026-12549
MAL-2026-12549
Summary: Malicious code in checkout-confirm-pos-order-sms-am (npm)
Details: Source: amazon-inspector (c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e) On require() of this package, index.js loads _init.js which invokes init() immediately. init() downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via split-join of small string fragments to evade static scanners. A DNS-TXT fallback reassembles the payload from base64 chunks served under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix or `dotnet_diag_<hex>.exe` on Windows mimicking a.NET diagnostic tool), chmod 0755 on Unix, and spawned detached via `/bin/sh -c '<path> &'` or `cmd.exe`; the spawn is unref()'d so it outlives the Node process. Execution is throttled by a /tmp cooldown file. The tarball also ships lib/telemetry.js (~81 KB, framed with 'Analytics SDK' comments) containing an equivalent dropper: split `require('child_'+'process')`, base64 chunk assembly, `fs['chmod'+'Sync'](path, 0o755)`, and `cp.spawn('/bin/sh', ['-c', filePath+' &'])`. The `require('child_process')`, `fs.chmodSync`, and `spawn` identifiers are string-split throughout to hide from keyword scanners. Package name lookalike of a checkout/POS SMS confirmation utility. Installing or requiring this package executes attacker-controlled native code on the installer's machine.
Affected packages
Package
Name: checkout-confirm-pos-order-sms-am
Purl: pkg:npm/checkout-confirm-pos-order-sms-am
Affected ranges
Type: N/A
Events:
