MAL-2026-12578

    Dashboard / Malicious Package / MAL-2026-12578

    MAL-2026-12578

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-mobile-pay-widget (npm)

    Details: Source: amazon-inspector (57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f) [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require() of the package, index.js unconditionally loads _adapter.js, which at module load selects a platform-specific payload, downloads it from one of four Cloudflare Workers mirrors whose hostnames are reconstructed at runtime via array-join splits (e.g. ["oob-worker.cf101-adf.worke","rs.dev"].join("")), with a DNS-TXT chunked base64 covert channel over *.dl.wel1.ru as fallback. The downloaded bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows — cover-story names impersonating benign runtime artifacts — chmod'd 0755, and spawned detached via /bin/sh -c "<path> &" or cmd /c start /b. A stamp file /tmp/.analytics_state gates re-execution (EXPIRE_SEC=22056), stderr is stubbed to no-ops, and DISABLE_TELEMETRY-style env vars are honored to appear inert in sandboxes. No hash or signature verification is performed; the fetched bytes are attacker-controlled. The package advertises a native mobile-pay bridge but ships no such functionality — the only effect of installing/requiring it is the drop-and-exec chain.

    References: https://www.npmjs.com/package/checkout-mobile-pay-widget/v/35.9.1

    Affected packages

    Package

    Name: checkout-mobile-pay-widget

    Purl: pkg:npm/checkout-mobile-pay-widget

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.1