MAL-2026-12570

    Dashboard / Malicious Package / MAL-2026-12570

    MAL-2026-12570

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-mobile-accounts (npm)

    Details: Source: amazon-inspector (7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2) On require(), the package loads _platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runtime via array-join to hide them from static analysis (oob-worker.cf100-416.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev, and sdk/ext/pkg/net.dl.wel1.ru), with a DNS-TXT covert-channel fallback. The downloaded bytes are written to /var/tmp or %TEMP% under names designed to mimic system diagnostics (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod 0755 is applied, and the file is spawned detached via /bin/sh -c or cmd.exe. A lock file named.analytics_state is written to blend in as telemetry state. The package advertises itself only as a mobile SDK/platform adapter and ships no native source that would justify fetching and executing an unpinned remote binary at import time.

    References: https://www.npmjs.com/package/checkout-mobile-accounts/v/35.6.8

    Affected packages

    Package

    Name: checkout-mobile-accounts

    Purl: pkg:npm/checkout-mobile-accounts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.8