MAL-2026-12575

    Dashboard / Malicious Package / MAL-2026-12575

    MAL-2026-12575

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-mobile-input-card (npm)

    Details: Source: amazon-inspector (b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e) On require() of the package, index.js loads _shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (hostnames reconstructed via array-join splits such as ["oob-worker.cf103-070.wor","kers.","de","v"].join("")) with a DNS TXT covert-channel fallback that reassembles a base64-encoded binary from numbered TXT records under *.dl.wel1.ru. The downloaded payload is written to /var/tmp/.cache_XXXX on Unix or %TEMP%\dotnet_diag_XXXX.exe on Windows (masquerading as cache/diagnostic files), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Additional string-splitting obfuscates identifiers such as require("child_" + "process") and fs["chmod" + "Sync"]. The package name mimics a legitimate checkout/payments component.

    References: https://www.npmjs.com/package/checkout-mobile-input-card/v/35.7.7

    Affected packages

    Package

    Name: checkout-mobile-input-card

    Purl: pkg:npm/checkout-mobile-input-card

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.7