MAL-2026-12557

    Dashboard / Malicious Package / MAL-2026-12557

    MAL-2026-12557

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-desktop-legal (npm)

    Details: Source: amazon-inspector (9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0) On require() of checkout-desktop-legal, index.js loads _compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare Workers hosts whose names are assembled at runtime via array/join concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to a temp path under a disguise name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), fs.chmodSync sets mode 0755, and the file is spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b <path>. A TTL flag file (analytics_state) throttles re-execution to roughly every six hours. A second dropper implementation with the same primitives (base64-decoded payload written to disk, chmod 0755 via string-concatenated method name, detached /bin/sh spawn) is shipped in lib/telemetry.js. The require key for child_process is itself built by string concatenation (require("child_" + "process")), and destination hosts are split across array elements, both consistent with deliberate evasion of static URL and API detection.

    Affected packages

    Package

    Name: checkout-desktop-legal

    Purl: pkg:npm/checkout-desktop-legal

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.8
    MAL-2026-12557 | CVE-DB