MAL-2026-12573
Dashboard / Malicious Package / MAL-2026-12573
MAL-2026-12573
Summary: Malicious code in checkout-mobile-cashback (npm)
Details: Source: amazon-inspector (82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4) [email protected] executes a staged binary dropper on module load. index.js requires./_shim, which selects a platform-specific binary URL from a hardcoded list of Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) assembled via array-join string splitting to evade static matching, with a DNS-TXT chunked base64 fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names imitating system tooling (.cache_<rand>, dotnet_diag_<rand>.exe), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed, the destinations are unrelated to any declared publisher, and the logging function is stubbed to a no-op while a DISABLE_TELEMETRY env-var opt-out provides a telemetry cover story. The behavior fires as a side effect of importing the package.
Affected packages
Package
Name: checkout-mobile-cashback
Purl: pkg:npm/checkout-mobile-cashback
Affected ranges
Type: N/A
Events:
