MAL-2026-12571
Dashboard / Malicious Package / MAL-2026-12571
MAL-2026-12571
Summary: Malicious code in checkout-mobile-accounts-old (npm)
Details: Source: amazon-inspector (67f6eeca2bb17729fe666aaaf6849e26c474a130f5a17ca7dfe6c4c6c6ae4e8a) On require() of checkout-mobile-accounts-old, index.js loads _support.js which downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT covert-channel fallback under wel1.ru (sdk./ext./pkg./net.dl.wel1.ru), stages the payload under /var/tmp or %TEMP% with disguised filenames (dotnet_diag_*.exe,.cache_*), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. The C2 hostnames are assembled at runtime by joining split string literals, and the DNS fallback reassembles a base64-encoded binary from numbered TXT records (c.<domain> for chunk count, 0..n.<domain> for chunks). Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK, plus a cooldown flag file, are checked to suppress the fetch. The delivery, obfuscation, disguised staging path, detached execution, and DNS-TXT fallback channel are all unrelated to the package's stated device-integration purpose and constitute full-host remote code execution against any installer that requires the package.
Affected packages
Package
Name: checkout-mobile-accounts-old
Purl: pkg:npm/checkout-mobile-accounts-old
Affected ranges
Type: N/A
Events:
