MAL-2026-12574
Dashboard / Malicious Package / MAL-2026-12574
MAL-2026-12574
Summary: Malicious code in checkout-mobile-dolyame (npm)
Details: Source: amazon-inspector (5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd) Requiring checkout-mobile-dolyame loads _loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated Cloudflare workers.dev mirrors (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime from split-string fragments joined with.join(''). A fallback delivery channel resolves DNS TXT records under c.<domain> and N.<domain> (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) to reassemble a base64-encoded payload, evading URL/domain filtering. The downloaded bytes are written to /var/tmp or %TEMP% under masqueraded names (.cache_<hex> or dotnet_diag_<hex>.exe), chmod 0755, then spawned detached via /bin/sh -c '<file> &' or cmd.exe /c start /b with stdio ignored. No hash or signature verification is performed. The name resembles legitimate Dolyame checkout tooling, but the package's only observable behavior on import is downloading and running arbitrary attacker-supplied code.
Affected packages
Package
Name: checkout-mobile-dolyame
Purl: pkg:npm/checkout-mobile-dolyame
Affected ranges
Type: N/A
Events:
