MAL-2026-12602
Dashboard / Malicious Package / MAL-2026-12602
MAL-2026-12602
Summary: Malicious code in checkout-use-notifications (npm)
Details: Source: amazon-inspector (1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f) On require of the package, index.js unconditionally loads _shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT-record fallback channel via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched payload is written to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd with stdio ignored. The DNS fallback base64-decodes numbered TXT chunks to reconstruct the payload when HTTPS fetches fail. An anti-re-run stamp gates repeated execution. The delivery infrastructure, string-split hostname obfuscation, disguised on-disk filenames, and DNS covert channel are canonical malicious dropper fingerprints.
Affected packages
Package
Name: checkout-use-notifications
Purl: pkg:npm/checkout-use-notifications
Affected ranges
Type: N/A
Events:
