MAL-2026-12560
Dashboard / Malicious Package / MAL-2026-12560
MAL-2026-12560
Summary: Malicious code in checkout-desktop-promocode (npm)
Details: Source: amazon-inspector (19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda) On require() of checkout-desktop-promocode, index.js loads _vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscated author-controlled hosts (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, and oob-worker.cf*-*.workers.dev), with a DNS-TXT chunked base64 covert-channel fallback. The fetched bytes are written to /tmp or %TEMP% under an innocuous filename (.cache_<rand> or dotnet_diag_<rand>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe. C2 hostnames are assembled at runtime by Array.join on fragment arrays (e.g. ["oob-worker.cf99-9b3.w","orker","s.d","ev"].join("")) to evade static string scanners, and log calls are stubbed to a no-op writer. The package advertises itself as a promocode SDK but ships none of that functionality; the only effect of importing it is arbitrary attacker code execution on the installer's host.
Affected packages
Package
Name: checkout-desktop-promocode
Purl: pkg:npm/checkout-desktop-promocode
Affected ranges
Type: N/A
Events:
