MAL-2026-12597
Dashboard / Malicious Package / MAL-2026-12597
MAL-2026-12597
Summary: Malicious code in checkout-todo-test (npm)
Details: Source: amazon-inspector (a87cb6c1e9ab39c21cd5d1031cadd2c192f86aaa337a62a7476657d5ee3f7f39) On require of this package, index.js loads _platform.js, which asynchronously downloads a platform-specific binary from anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomain records under *.dl.wel1.ru. The destination hostnames are assembled at runtime by joining split string fragments to evade static analysis. The downloaded bytes are written to a temp path with a disguised name (.cache_XXXX on Unix, dotnet_diag_XXXX.exe on Windows), chmod 0755 on Unix, and executed via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd.exe /c start /b. There is no hash or signature verification, and the hosts are not publisher-controlled infrastructure. The tarball also ships an unreferenced sibling module lib/telemetry.js (~81 KB) containing the same download→chmod→spawn pattern as latent staged code. The package presents its behavior as "telemetry/analytics" with env-var opt-outs, but the runtime-reconstructed C2 destinations, DNS covert channel, and disguised on-disk artifacts are inconsistent with legitimate telemetry.
Affected packages
Package
Name: checkout-todo-test
Purl: pkg:npm/checkout-todo-test
Affected ranges
Type: N/A
Events:
