{"id":"MAL-2026-12551","summary":"Malicious code in checkout-create-draft-agreement-am (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977)\nOn require of checkout-create-draft-agreement-am, index.js loads _polyfill.js which downloads a platform-specific native binary from Cloudflare Workers hosts whose names are assembled by joining split character arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT covert fallback channel on *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) that retrieves base64-chunked payloads via c.\u003cdomain\u003e and i.\u003cdomain\u003e TXT queries. The fetched bytes are written to /var/tmp/.cache_\u003cuid\u003e (or Temp\\dotnet_diag_\u003cuid\u003e.exe on Windows), chmod 0755, and spawned detached via child_process.spawn(\"/bin/sh\" or \"cmd\"). No hash or signature verification is performed, hosts are unrelated to the package's declared 'checkout draft agreement' purpose, and the TTL marker is disguised as 'analytics_state' with a self-labeled telemetry opt-out as cover.\n","modified":"2026-08-05T14:35:19.439939706Z","published":"2026-08-05T14:15:56Z","database_specific":{"malicious-packages-origins":[{"sha256":"10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977","source":"amazon-inspector","versions":["35.1.1"],"id":"IN-MAL-2026-015231","import_time":"2026-08-05T14:20:15.046589511Z","modified_time":"2026-08-05T14:15:56Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-create-draft-agreement-am/v/35.1.1"}],"affected":[{"package":{"name":"checkout-create-draft-agreement-am","ecosystem":"npm","purl":"pkg:npm/checkout-create-draft-agreement-am"},"versions":["35.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"45f9b40c9ce92c6ceb8ea5d302ed8a277fba505d83a9b5aa8b770a749f8807d8","tlsh":"c0b1655a0666b0084af0e7e487178825f65ff6533781c284fb9c69945f7352483b2efc","path":"_polyfill.js"}],"package_integrity":[{"hashes":{"sha1":"2a91a820f541fba77f57469e54f4ac46f6e2e701","sha512_sri":"sha512-Ot4qsmXOvVCkFjN6SVYTx6bnXUbVcyvXbUXJaMrl6aMQ7YGEITH8hPe7Fsj1RTfm1gCn0f2t2Ri9YWT2QUYUJQ=="},"filename":"checkout-create-draft-agreement-am-35.1.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-create-draft-agreement-am/MAL-2026-12551.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}