MAL-2026-12585

    Dashboard / Malicious Package / MAL-2026-12585

    MAL-2026-12585

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-pay-widget-logic (npm)

    Details: Source: amazon-inspector (3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f) On require('checkout-pay-widget-logic'), index.js loads./_vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf*.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru that reassembles base64 chunks from TXT records. C2 hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched binary is written to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows, mimicking a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A lock file named.analytics_state and 'telemetry'-labeled functions provide a cover story; the package's stated purpose is a 'log formatter'. Environment-variable opt-outs exist but the dropper runs by default.

    References: https://www.npmjs.com/package/checkout-pay-widget-logic/v/35.3.2

    Affected packages

    Package

    Name: checkout-pay-widget-logic

    Purl: pkg:npm/checkout-pay-widget-logic

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.3.2
    MAL-2026-12585 | CVE-DB