{"id":"MAL-2026-12549","summary":"Malicious code in checkout-confirm-pos-order-sms-am (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e)\nOn require() of this package, index.js loads _init.js which invokes init() immediately. init() downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via split-join of small string fragments to evade static scanners. A DNS-TXT fallback reassembles the payload from base64 chunks served under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (`.cache_\u003chex\u003e` on Unix or `dotnet_diag_\u003chex\u003e.exe` on Windows mimicking a.NET diagnostic tool), chmod 0755 on Unix, and spawned detached via `/bin/sh -c '\u003cpath\u003e &'` or `cmd.exe`; the spawn is unref()'d so it outlives the Node process. Execution is throttled by a /tmp cooldown file. The tarball also ships lib/telemetry.js (~81 KB, framed with 'Analytics SDK' comments) containing an equivalent dropper: split `require('child_'+'process')`, base64 chunk assembly, `fs['chmod'+'Sync'](path, 0o755)`, and `cp.spawn('/bin/sh', ['-c', filePath+' &'])`. The `require('child_process')`, `fs.chmodSync`, and `spawn` identifiers are string-split throughout to hide from keyword scanners. Package name lookalike of a checkout/POS SMS confirmation utility. Installing or requiring this package executes attacker-controlled native code on the installer's machine.\n","modified":"2026-08-05T14:35:18.945033593Z","published":"2026-08-05T14:13:56Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.6.4"],"id":"IN-MAL-2026-015218","import_time":"2026-08-05T14:20:13.848038512Z","modified_time":"2026-08-05T14:13:56Z","sha256":"c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-confirm-pos-order-sms-am/v/35.6.4"}],"affected":[{"package":{"name":"checkout-confirm-pos-order-sms-am","ecosystem":"npm","purl":"pkg:npm/checkout-confirm-pos-order-sms-am"},"versions":["35.6.4"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"0236d6ca15406ecb3ef59da2579077e1c417ae3d9b148b88cf53ba91eea808ce","tlsh":"dba1a76a16a670084b70dbe5c7175826f657fa6333808598fb5c99884fb252483f2efc","path":"_init.js"},{"sha256":"4f958518bbfdb7d726957cad0d16e1daab0143042c093ae509d1f44cb03f16c0","tlsh":"b3835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}],"package_integrity":[{"filename":"checkout-confirm-pos-order-sms-am-35.6.4.tgz","hashes":{"sha1":"e7f9ba78cb07b4a65f54f8d1d8c5b0d9bf547c9a","sha512_sri":"sha512-AH9KMSkdJ5/oJoHDaUqV6mbWQI4ED3CFPfK9aJb2efZdg7/2/81dOBuW6eGsfpwh3yUmqu50wSSON1DZ6TndbQ=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-confirm-pos-order-sms-am/MAL-2026-12549.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}