MAL-2026-12599

    Dashboard / Malicious Package / MAL-2026-12599

    MAL-2026-12599

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in checkout-types (npm)

    Details: Source: amazon-inspector (5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731) On require of checkout-types, index.js loads _vendor.js which runs setup() at top level. The code reconstructs C2 hostnames from split string arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT chunked-base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded, written to a temp path disguised as dotnet_diag_<rand>.exe on Windows or.cache_<rand> on Unix, chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd on Windows. Split-string obfuscation of destinations, DNS covert-channel fallback, cover-story file names, and detached spawn on module load result in arbitrary attacker-controlled code execution on the installer's host at require time.

    References: https://www.npmjs.com/package/checkout-types/v/35.6.8

    Affected packages

    Package

    Name: checkout-types

    Purl: pkg:npm/checkout-types

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.8
    MAL-2026-12599 | CVE-DB