MAL-2026-12557
Dashboard / Malicious Package / MAL-2026-12557
MAL-2026-12557
Summary: Malicious code in checkout-desktop-legal (npm)
Details: Source: amazon-inspector (9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0) On require() of checkout-desktop-legal, index.js loads _compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare Workers hosts whose names are assembled at runtime via array/join concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to a temp path under a disguise name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), fs.chmodSync sets mode 0755, and the file is spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b <path>. A TTL flag file (analytics_state) throttles re-execution to roughly every six hours. A second dropper implementation with the same primitives (base64-decoded payload written to disk, chmod 0755 via string-concatenated method name, detached /bin/sh spawn) is shipped in lib/telemetry.js. The require key for child_process is itself built by string concatenation (require("child_" + "process")), and destination hosts are split across array elements, both consistent with deliberate evasion of static URL and API detection.
Affected packages
Package
Name: checkout-desktop-legal
Purl: pkg:npm/checkout-desktop-legal
Affected ranges
Type: N/A
Events:
