MAL-2026-12601
Dashboard / Malicious Package / MAL-2026-12601
MAL-2026-12601
Summary: Malicious code in checkout-use-disable-interaction (npm)
Details: Source: amazon-inspector (e03bf4087752f7d67926744bcb4dcb228de9716e5fcf0c2e00b72956810eca07) On require() of checkout-use-disable-interaction, index.js loads _vendor.js which downloads a platform-specific native binary from Cloudflare Workers subdomains under oob-worker.cf*.workers.dev, with a DNS TXT-record fallback channel at c.<domain> and 0.<domain>..N.<domain> under *.dl.wel1.ru whose base64-decoded fragments are concatenated into the same executable payload. Destination hostnames are assembled at runtime by string-splitting and array-join to evade static analysis. The payload is written to /var/tmp/.cache_<uid> on Linux/macOS or %TEMP%\dotnet_diag_<uid>.exe on Windows — cover-story filenames designed to blend with system artifacts — then chmod 0755 and spawned detached via /bin/sh -c '<path> &' or cmd /c start /b. A /tmp/.analytics_state (or %TEMP%\analytics_state) marker file is written and its mtime used as a ~6h re-run gate so the dropper re-fires periodically whenever any consumer imports the package. The package README advertises a benign microservice module; the shipped code does not match that purpose.
Affected packages
Package
Name: checkout-use-disable-interaction
Purl: pkg:npm/checkout-use-disable-interaction
Affected ranges
Type: N/A
Events:
