{"id":"MAL-2026-12544","summary":"Malicious code in checkout-base-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2)\nOn require() of this package, index.js loads _helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split string fragments joined at runtime (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), selects a platform-specific endpoint, fetches an opaque binary via https.get, writes it to /var/tmp or %TEMP% under a disguised filename (.cache_\u003chex\u003e on POSIX, dotnet_diag_\u003chex\u003e.exe on Windows), chmods it 0755, and spawns it detached via spawn(\"/bin/sh\", [\"-c\",...]) or spawn(\"cmd\",...). A DNS-TXT chunked base64 covert-channel fallback contacts *.dl.wel1.ru when the HTTPS hosts are unreachable. Additional evasion: require(\"child_\" + \"process\") string concatenation in lib/telemetry.js, environment-variable gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, and a filesystem session stamp to fire once per host. The disguised filenames (dotnet_diag_,.cache_) impersonate legitimate diagnostic artifacts. The package name resembles a checkout/test utility but ships no functionality matching that purpose.\n","modified":"2026-08-05T14:35:09.982391521Z","published":"2026-08-05T14:14:41Z","database_specific":{"malicious-packages-origins":[{"versions":["35.9.3"],"id":"IN-MAL-2026-015223","import_time":"2026-08-05T14:20:14.318939313Z","modified_time":"2026-08-05T14:14:41Z","sha256":"3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-base-test/v/35.9.3"}],"affected":[{"package":{"name":"checkout-base-test","ecosystem":"npm","purl":"pkg:npm/checkout-base-test"},"versions":["35.9.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-base-test/MAL-2026-12544.json","indicators":{"package_integrity":[{"filename":"checkout-base-test-35.9.3.tgz","hashes":{"sha512_sri":"sha512-EaSv7Im6lj58tAbrRwBOdi3PphPpze2N1L5X9qW/ZJnqNL+jYUrzPr2lytP8nQUaLEEcnlGl/rPNIqJhJkagiw==","sha1":"6b1236ef01dc41a2a599d3692ed2c9e77c6813f2"}}],"evidence_files":[{"path":"_helpers.js","sha256":"915289c3afda2c1678b8690f5f6c7d694fb046fc270bf267a4bf46c6d630a6c8","tlsh":"9da1965a16ab7018cbb1dbf487075416f66be6633380c694fb9c69841f7212483b2efc"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}