{"id":"MAL-2026-12567","summary":"Malicious code in checkout-input-card-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb)\nOn require() of the package, index.js loads _vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains (oob-worker.cf*.workers.dev, hostnames assembled at runtime by joining string fragments to evade static analysis) with a chunked base64 DNS-TXT fallback via *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under cover names (`.cache_\u003crand\u003e`, `dotnet_diag_\u003crand\u003e.exe`, `analytics_state`), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe. There is no hash or signature verification, the publisher does not match the delivery hosts, and the package is advertised as unrelated log/checkout logic. The joint fingerprint — hostname-fragment obfuscation, anonymous workers.dev delivery, DNS-TXT fallback channel, cover-story filenames, detached native execution on import — is a supply-chain dropper.\n","modified":"2026-08-05T14:35:27.954984176Z","published":"2026-08-05T14:11:53Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:20:12.630609993Z","modified_time":"2026-08-05T14:11:53Z","sha256":"1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb","source":"amazon-inspector","versions":["35.8.8"],"id":"IN-MAL-2026-015204"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-input-card-logic/v/35.8.8"}],"affected":[{"package":{"name":"checkout-input-card-logic","ecosystem":"npm","purl":"pkg:npm/checkout-input-card-logic"},"versions":["35.8.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"checkout-input-card-logic-35.8.8.tgz","hashes":{"sha1":"2e77460cf82bd038a89202a4a8391045868a07c0","sha512_sri":"sha512-iK945wik0bSTzYhjGOok9EOe/Mx1dlVK3xKPCrtkrh6MX4YL26flXd++GmkZFuSbVcPnJFAnx+oBnJ55Fzq7HQ=="}}],"evidence_files":[{"tlsh":"5ea1759a15a670098bb0ebf4c7175826f65be76333808588fb9c59884f7612483b1efc","path":"_vendor.js","sha256":"1cd9fa257d04f41950b8dcadff41d5b19e5d7ec33020a83bdd32af3bdcedd195"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-input-card-logic/MAL-2026-12567.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}