MAL-2026-12598
Dashboard / Malicious Package / MAL-2026-12598
MAL-2026-12598
Summary: Malicious code in checkout-total-logic (npm)
Details: Source: amazon-inspector (297980540b58c9daf802d92602f2a809348bd6ac1492537d6e291f704702dc0a) On require of the package, index.js loads _platform.js, which reconstructs endpoint hostnames from split string fragments resolving to oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS TXT-record chunked-base64 fallback channel over *.dl.wel1.ru. _platform.js:74 issues https.get to those hosts, writes the returned platform-specific binary to a temp path using decoy filenames (dotnet_diag_*.exe,.cache_*), chmods it 0o755 on Unix, and detached-spawns it via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}) on Unix or spawn('cmd',...) on Windows. There is no hash or signature verification, the destination hosts are not publisher-associated, and the package presents itself as a trivial log transport, contradicting the fetch-and-execute behavior. A cooldown flag is dropped in /tmp. The result is unauthenticated remote code execution on any developer or CI host that installs and requires this package.
Affected packages
Package
Name: checkout-total-logic
Purl: pkg:npm/checkout-total-logic
Affected ranges
Type: N/A
Events:
