MAL-2026-12595
Dashboard / Malicious Package / MAL-2026-12595
MAL-2026-12595
Summary: Malicious code in checkout-test-component (npm)
Details: Source: amazon-inspector (c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0) On require() of the package, index.js loads./_runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS/TXT fallback to *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under cover-story names (.cache_<hex>, dotnet_diag_<hex>.exe, analytics_state), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are constructed by fragment-and-.join("") to evade static analysis. A secondary dropper implementation is shipped as lib/telemetry.js (~81 KB) using base64 chunk decoding, cp.spawn("/bin/sh", ["-c", filePath + " &"]), and fs["chmod"+"Sync"] with 0755, framed as an analytics.node SDK — duplicating the dropper mechanism as a dormant secondary payload. The package name resembles a benign test/checkout utility but contains no such functionality; its sole effect on load is to drop and execute attacker-controlled code on the installer's host.
Affected packages
Package
Name: checkout-test-component
Purl: pkg:npm/checkout-test-component
Affected ranges
Type: N/A
Events:
