{"id":"MAL-2026-12543","summary":"Malicious code in checkout-base-analytics-data (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa)\nOn require of the package's main (index.js), the hidden _polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an unverified binary over HTTPS from hostnames assembled at runtime via string-array concatenation (oob-worker.cf101-adf.workers.dev and sibling *.workers.dev endpoints, with a DNS-TXT chunked fallback via *.wel1.ru subdomains including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the bytes to /var/tmp or %TEMP% under disguised names such as.cache_\u003chex\u003e and dotnet_diag_\u003chex\u003e.exe, chmods the file to 0755, and spawns it detached via /bin/sh or cmd. Endpoint hostnames are split into fragments and reassembled with Array.join to defeat static URL/domain matching, and index.js loads _polyfill unconditionally inside a try/catch so import failure is silenced. The package's declared purpose (a generic 'analytics data runtime support module') and empty dependency list are inconsistent with any legitimate need for a hidden native-binary loader fetching from unrelated *.workers.dev hosts.\n","modified":"2026-08-05T14:35:09.137628363Z","published":"2026-08-05T14:16:04Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:16:04Z","sha256":"a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa","source":"amazon-inspector","versions":["35.9.1"],"id":"IN-MAL-2026-015232","import_time":"2026-08-05T14:20:15.126681964Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-base-analytics-data/v/35.9.1"}],"affected":[{"package":{"name":"checkout-base-analytics-data","ecosystem":"npm","purl":"pkg:npm/checkout-base-analytics-data"},"versions":["35.9.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-base-analytics-data/MAL-2026-12543.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"checkout-base-analytics-data-35.9.1.tgz","hashes":{"sha512_sri":"sha512-hNIqZyDffLcK5s8GvdAq30yDQBkjncZjSZYZapkPd7MwqMjCW+sqQ8sykCQLbtAn+oGuaR6HupMUIse52MUB/w==","sha1":"df742fe4e5a1c83ca9974741c8b33c16678a4638"}}],"evidence_files":[{"path":"_polyfill.js","sha256":"e9ba856166eb81c4dfb356ae53a0841f657901aa90b2edf922cedbed145b288b","tlsh":"f9a1875a16aa70198bb0e7f4c7175819f65af6733380c188f75c69944f7712882b2efc"},{"tlsh":"9fd0a7111850702304be67929ca145067b620f2f2674cc0b21776268215067324ef326","path":"package.json","sha256":"c80de6847f4e6e7ebdc6a8f5a185fd659f3ab2624503192657a18920ba9cc24d"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}