{"id":"MAL-2026-12552","summary":"Malicious code in checkout-create-token (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193)\nPackage advertises itself as a token-generation library but its main entry index.js silently side-loads _platform.js via a try/catch require. On import, _platform.js runs an init() that assembles command-and-control hostnames by array-join concatenation (cf99-*.workers.dev, cf9b3/101-adf/102-baf/103-070.workers.dev) with a DNS-TXT fallback under wel1.ru (dnsTxt() enumerates TXT records under c.\u003cdomain\u003e and reassembles a base64 payload), downloads a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under decoy names (dotnet_diag_*,.cache_*,.analytics_state), chmods 0755 on POSIX, and spawns it detached via spawn(\"/bin/sh\", [\"-c\", fp+\" &\"]) or cmd.exe /c start. Env-var gates named DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as cover to mimic legitimate telemetry. The binary-drop-and-execute behavior is unrelated to the package's advertised token-generation purpose.\n","modified":"2026-08-05T14:35:20.236225511Z","published":"2026-08-05T14:14:50Z","database_specific":{"malicious-packages-origins":[{"sha256":"bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193","source":"amazon-inspector","versions":["35.5.6"],"id":"IN-MAL-2026-015224","import_time":"2026-08-05T14:20:14.401715492Z","modified_time":"2026-08-05T14:14:50Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-create-token/v/35.5.6"}],"affected":[{"package":{"name":"checkout-create-token","ecosystem":"npm","purl":"pkg:npm/checkout-create-token"},"versions":["35.5.6"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"checkout-create-token-35.5.6.tgz","hashes":{"sha512_sri":"sha512-ArzmBeWIxm2IcJm2KpCmGhOFHvph52QQDnlLt2ncHf+5pvFw0A4vud+xZBKEHjedUHd3Y3Dm5bv/rfjtADzQQA==","sha1":"a6ee3bf4a452bba7a4173f39bb532917cdbc4fe0"}}],"evidence_files":[{"sha256":"31fd2abc445bcf3f7ce35b3998a3dab303f4908ea685f7dc43877d1d359432e2","tlsh":"5aa1959a166a701887b09be48b175816f65ef6733780c5c4fa5c69d81fb212483b1efc","path":"_platform.js"},{"path":"index.js","sha256":"bd5fbdcb9fcd9ae57452752236d1c2b4230b8ff2373e186b9e9df4c4330b89ec","tlsh":"4601805207f4b129cae853b79f13c003fd15e07626854668774453ee9ef58100366db8"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-create-token/MAL-2026-12552.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}