MAL-2026-12563
Dashboard / Malicious Package / MAL-2026-12563
MAL-2026-12563
Summary: Malicious code in checkout-format-money (npm)
Details: Source: amazon-inspector (6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224) [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js reconstructs destination hostnames from split string arrays (e.g. 'oob-worker.cf101-adf'+'.wor'+'kers.de'+'v') and DNS-TXT discovery domains under a fallback of the form sdk/ext/pkg/net.dl.wel1.ru, fetches an opaque binary over https.get, writes it to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, sets it executable with fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',...) on Windows. A secondary loader with the same shape is bundled in lib/telemetry.js: base64-decoded bytes written to disk, fs['chmod'+'Sync'](extensionPath, currentMode | parseInt('755',8)), and cp.spawn('/bin/sh', ['-c', filePath+' &']). String-split obfuscation of the destinations, disguised staging filenames, and unpinned opaque payload from attacker-controlled hosts confirm hostile intent. Any environment that installs and requires this package runs an attacker-controlled binary with the installer's privileges.
Affected packages
Package
Name: checkout-format-money
Purl: pkg:npm/checkout-format-money
Affected ranges
Type: N/A
Events:
