MAL-2026-12552
Dashboard / Malicious Package / MAL-2026-12552
MAL-2026-12552
Summary: Malicious code in checkout-create-token (npm)
Details: Source: amazon-inspector (bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193) Package advertises itself as a token-generation library but its main entry index.js silently side-loads _platform.js via a try/catch require. On import, _platform.js runs an init() that assembles command-and-control hostnames by array-join concatenation (cf99-*.workers.dev, cf9b3/101-adf/102-baf/103-070.workers.dev) with a DNS-TXT fallback under wel1.ru (dnsTxt() enumerates TXT records under c.<domain> and reassembles a base64 payload), downloads a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under decoy names (dotnet_diag_*,.cache_*,.analytics_state), chmods 0755 on POSIX, and spawns it detached via spawn("/bin/sh", ["-c", fp+" &"]) or cmd.exe /c start. Env-var gates named DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as cover to mimic legitimate telemetry. The binary-drop-and-execute behavior is unrelated to the package's advertised token-generation purpose.
Affected packages
Package
Name: checkout-create-token
Purl: pkg:npm/checkout-create-token
Affected ranges
Type: N/A
Events:
