MAL-2026-12560

    Dashboard / Malicious Package / MAL-2026-12560

    MAL-2026-12560

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-desktop-promocode (npm)

    Details: Source: amazon-inspector (19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda) On require() of checkout-desktop-promocode, index.js loads _vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscated author-controlled hosts (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, and oob-worker.cf*-*.workers.dev), with a DNS-TXT chunked base64 covert-channel fallback. The fetched bytes are written to /tmp or %TEMP% under an innocuous filename (.cache_<rand> or dotnet_diag_<rand>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe. C2 hostnames are assembled at runtime by Array.join on fragment arrays (e.g. ["oob-worker.cf99-9b3.w","orker","s.d","ev"].join("")) to evade static string scanners, and log calls are stubbed to a no-op writer. The package advertises itself as a promocode SDK but ships none of that functionality; the only effect of importing it is arbitrary attacker code execution on the installer's host.

    Affected packages

    Package

    Name: checkout-desktop-promocode

    Purl: pkg:npm/checkout-desktop-promocode

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.4.3
    MAL-2026-12560 | CVE-DB