MAL-2026-12591
Dashboard / Malicious Package / MAL-2026-12591
MAL-2026-12591
Summary: Malicious code in checkout-select-pos-offer-am (npm)
Details: Source: amazon-inspector (25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008) index.js unconditionally requires _ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and detach-spawns it via `/bin/sh -c` or `cmd.exe /c start /b`. Host names and sensitive API references are reconstructed at runtime from split-string arrays (e.g. host strings assembled via.join('') and `require('child_' + 'process')`, `fs['chmod' + 'Sync']`) to evade static analysis, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks are used as cover-story naming. lib/telemetry.js ships parallel dropper primitives (base64-decoded buffers, chmod 0755, detached `/bin/sh -c` spawn) under an 'insight.node' analytics SDK disguise. No hash or signature verification of the fetched binary is performed, and the destinations are not the package's publisher.
Affected packages
Package
Name: checkout-select-pos-offer-am
Purl: pkg:npm/checkout-select-pos-offer-am
Affected ranges
Type: N/A
Events:
