MAL-2026-12583

    Dashboard / Malicious Package / MAL-2026-12583

    MAL-2026-12583

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-parameters (npm)

    Details: Source: amazon-inspector (cc0cff223506622cf77c0c0c038390701fbc4dfa3bb8a1be146263a9eede7774) On require('checkout-parameters'), index.js loads _vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on the installer's machine. Destination hostnames are reconstructed at runtime via string-split concatenation (e.g. array `.join("")` producing subdomains under `.workers.dev`, with a `.dl.wel1.ru` fallback) to hide them from static inspection. The fetched payload is written to a disguised hidden path (`/var/tmp/.cache_<hex>` on Unix, `%TEMP%\dotnet_diag_<hex>.exe` on Windows), chmod'd to 0755, and launched detached via `/bin/sh -c` or `cmd /c start /b`. A sibling module lib/telemetry.js ships the same fetch → base64-decode → write → chmod 0755 → spawn("/bin/sh",["-c", path+" &"]) pattern under an 'analytics SDK' cover story, and uses concatenated identifiers (`require("child_"+"process")`, `fs["chmod"+"Sync"]`) as further evasion. Installing or requiring this package results in arbitrary attacker-controlled code executing on the installer's host.

    References: https://www.npmjs.com/package/checkout-parameters/v/35.8.5

    Affected packages

    Package

    Name: checkout-parameters

    Purl: pkg:npm/checkout-parameters

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.5