MAL-2026-12589
Dashboard / Malicious Package / MAL-2026-12589
MAL-2026-12589
Summary: Malicious code in checkout-public-tokens (npm)
Details: Source: amazon-inspector (c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536) On require() of checkout-public-tokens, index.js loads _platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT base64 fallback resolver via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The payload is written to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are constructed at runtime by joining split literals, and in-file comments frame the download-and-execute chain as telemetry, analytics, and cache validation. The package advertises itself as a token utility; the hosts and behavior are unrelated to any documented purpose and there is no hash or signature verification of the fetched bytes.
Affected packages
Package
Name: checkout-public-tokens
Purl: pkg:npm/checkout-public-tokens
Affected ranges
Type: N/A
Events:
