{"id":"MAL-2026-12575","summary":"Malicious code in checkout-mobile-input-card (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e)\nOn require() of the package, index.js loads _shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (hostnames reconstructed via array-join splits such as [\"oob-worker.cf103-070.wor\",\"kers.\",\"de\",\"v\"].join(\"\")) with a DNS TXT covert-channel fallback that reassembles a base64-encoded binary from numbered TXT records under *.dl.wel1.ru. The downloaded payload is written to /var/tmp/.cache_XXXX on Unix or %TEMP%\\dotnet_diag_XXXX.exe on Windows (masquerading as cache/diagnostic files), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Additional string-splitting obfuscates identifiers such as require(\"child_\" + \"process\") and fs[\"chmod\" + \"Sync\"]. The package name mimics a legitimate checkout/payments component.\n","modified":"2026-08-05T14:35:30.954405585Z","published":"2026-08-05T14:11:27Z","database_specific":{"malicious-packages-origins":[{"sha256":"b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e","source":"amazon-inspector","versions":["35.7.7"],"id":"IN-MAL-2026-015201","import_time":"2026-08-05T14:20:12.365603641Z","modified_time":"2026-08-05T14:11:27Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-mobile-input-card/v/35.7.7"}],"affected":[{"package":{"name":"checkout-mobile-input-card","ecosystem":"npm","purl":"pkg:npm/checkout-mobile-input-card"},"versions":["35.7.7"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-EK1T2yhER1a1XKR1RehuQ8BPA3o040ddKYlcH5y74Gs9eTlMK1D8olRIq/Hqd/dD/NBQTWrP6bWH0mlsRAkLIQ==","sha1":"5874b3d9ed650f6dfdf6953695705b7a96cdd8ad"},"filename":"checkout-mobile-input-card-35.7.7.tgz"}],"evidence_files":[{"sha256":"75763f8d7d1432cddead88e143286ffd83a28349b43c7bfd01379a3b3c55d8a9","tlsh":"81a1c76a16a530184bb0d7e0c7175416f55af2633380d2d4fbaca5980fb322483b2efc","path":"_shim.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-input-card/MAL-2026-12575.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}