MAL-2026-12592
Dashboard / Malicious Package / MAL-2026-12592
MAL-2026-12592
Summary: Malicious code in checkout-storage-service (npm)
Details: Source: amazon-inspector (9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1) On require of checkout-storage-service, _helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched payload is written to /tmp/.cache_<hex> on Unix or TEMP\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Host strings are assembled from split arrays via.join('') to evade static analysis, execution is throttled by a TTL flag file and DO_NOT_TRACK-style env checks styled as opt-out telemetry, and stderr logging is silenced by a no-op sink. The destination hosts are anonymous Cloudflare Workers unrelated to the package publisher, the payload is opaque, and the staged filenames (hidden dotfile in /tmp, dotnet_diag masquerade on Windows) are intended to blend into normal system paths.
Affected packages
Package
Name: checkout-storage-service
Purl: pkg:npm/checkout-storage-service
Affected ranges
Type: N/A
Events:
