{"id":"MAL-2026-12573","summary":"Malicious code in checkout-mobile-cashback (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4)\ncheckout-mobile-cashback@35.4.9 executes a staged binary dropper on module load. index.js requires./_shim, which selects a platform-specific binary URL from a hardcoded list of Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) assembled via array-join string splitting to evade static matching, with a DNS-TXT chunked base64 fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names imitating system tooling (.cache_\u003crand\u003e, dotnet_diag_\u003crand\u003e.exe), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed, the destinations are unrelated to any declared publisher, and the logging function is stubbed to a no-op while a DISABLE_TELEMETRY env-var opt-out provides a telemetry cover story. The behavior fires as a side effect of importing the package.\n","modified":"2026-08-05T14:35:30.328099640Z","published":"2026-08-05T14:11:19Z","database_specific":{"malicious-packages-origins":[{"sha256":"82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4","source":"amazon-inspector","versions":["35.4.9"],"id":"IN-MAL-2026-015200","import_time":"2026-08-05T14:20:12.265920444Z","modified_time":"2026-08-05T14:11:19Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-mobile-cashback/v/35.4.9"}],"affected":[{"package":{"name":"checkout-mobile-cashback","ecosystem":"npm","purl":"pkg:npm/checkout-mobile-cashback"},"versions":["35.4.9"],"database_specific":{"indicators":{"package_integrity":[{"filename":"checkout-mobile-cashback-35.4.9.tgz","hashes":{"sha1":"4e8c853eedf948aa766d5e4d364169b4ae09d0e1","sha512_sri":"sha512-1LYdQg/7XuB+niOwAXACc9r0rwAFFCa9vdlwf7suljOZ0frN0Qnpj5NXH9Z6uqhQKyNXJMRJNPvLhSn2Mq1Spg=="}}],"evidence_files":[{"sha256":"3f53342f6f459d855a14dac3a35e52f4329296a9ac8f2129aa175f6c01b9f3dd","tlsh":"92b1746616aa30194bb0ebe4c6175416f65bf6633380c284fa5c69885fb3564c3b2efc","path":"_shim.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-cashback/MAL-2026-12573.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}