{"id":"MAL-2026-12541","summary":"Malicious code in checkout-accounts-holder (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a)\nOn `require('checkout-accounts-holder')`, index.js loads _platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames assembled at runtime via `.join(\"\")` over split string fragments (resolving to `oob-worker.cf100-416.workers.dev` with a DNS TXT fallback under `sdk.dl.wel1.ru`), writes the opaque payload to /tmp or %TEMP% under cover names such as `.cache_\u003crand\u003e` and `dotnet_diag_\u003crand\u003e.exe`, chmods it 0o755, and spawns it detached via `/bin/sh -c \"\u003cpath\u003e &\"` or `cmd.exe /c start`. The module presents itself as `analytics_state`/telemetry. A second dropper of the same shape ships in lib/telemetry.js (base64-chunked payload, `fs[\"chmod\"+\"Sync\"]`, `require(\"child_\"+\"process\")`, `spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"])`), currently unreferenced but present in the published tarball. Destination hostnames are string-split to evade plain-text scanners, and the run-write-chmod-spawn chain executes attacker-controlled bytes with the installer's privileges.\n","modified":"2026-08-05T14:35:08.557088273Z","published":"2026-08-05T14:15:27Z","database_specific":{"malicious-packages-origins":[{"sha256":"cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a","source":"amazon-inspector","versions":["35.2.3"],"id":"IN-MAL-2026-015228","import_time":"2026-08-05T14:20:14.814083459Z","modified_time":"2026-08-05T14:15:27Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-accounts-holder/v/35.2.3"}],"affected":[{"package":{"name":"checkout-accounts-holder","ecosystem":"npm","purl":"pkg:npm/checkout-accounts-holder"},"versions":["35.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"checkout-accounts-holder-35.2.3.tgz","hashes":{"sha512_sri":"sha512-7OpQVJMQ8kBkcOGzzvN3kVt4Dg+FuKDR8ZiolAM31/SoCiXThKTVGRKm7xJn3cMLysAATKiSwZKlOICCqUpkLg==","sha1":"c85f6f4c4de4495b197dd2771c33b382e5bdc5f7"}}],"evidence_files":[{"sha256":"b114f027f7f805b7573c59246f3701ea56ba2dca4c3fe719e5554d17ba24bcf7","tlsh":"7da1a69a066570188bb097e5c7274416f55bf6633380c6d4f7aca5981fb712483b2efc","path":"_platform.js"},{"sha256":"df016932a45ed41d75147ab3382dbd1d4dcf8991e88950ce07b0a236e47bc648","tlsh":"28835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-accounts-holder/MAL-2026-12541.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}