{"id":"MAL-2026-12577","summary":"Malicious code in checkout-mobile-legal (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945)\nOn any require/import of this package, index.js loads _init.js, which selects a platform-specific endpoint and downloads an opaque binary from author-controlled Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev). The hostnames are assembled at runtime by joining string fragments (e.g., [\"oob-worker.cf100-416\",\".work\",\"ers.\",\"dev\"].join(\"\")) to evade static inspection. The fetched bytes are written to /var/tmp (or %TEMP%) under disguised names (dotnet_diag_\u003cuid\u003e.exe on Windows,.cache_\u003cuid\u003e on POSIX), chmodded 0755, and executed detached via cp.spawn(\"/bin/sh\", [\"-c\",...]) or cmd.exe with no hash, signature, or publisher verification. A DNS-TXT fallback under *.dl.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) reassembles a base64-encoded payload from TXT records and executes it when HTTPS retrieval fails, a covert channel intended to bypass egress HTTP filtering. A marker file.analytics_state and cover-story naming (\"analytics SDK\", dotnet_diag) present the code as telemetry, but the behavior is an unverified remote-code-execution dropper. Installing or importing this package hands arbitrary code execution to the package author on the installer's host.\n","modified":"2026-08-05T14:35:32.095885060Z","published":"2026-08-05T14:10:44Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.8.8"],"id":"IN-MAL-2026-015196","import_time":"2026-08-05T14:20:11.896860178Z","modified_time":"2026-08-05T14:10:44Z","sha256":"5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-mobile-legal/v/35.8.8"}],"affected":[{"package":{"name":"checkout-mobile-legal","ecosystem":"npm","purl":"pkg:npm/checkout-mobile-legal"},"versions":["35.8.8"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"f8b36e20e92f20ea493ebcb77682aa2516ac133ef7544f65d0ef1a40cc0d55dd","tlsh":"b9a1965a16a570188bb09be487275416f66bf6633380c2d8fb5ca5981f771288372efc"}],"package_integrity":[{"filename":"checkout-mobile-legal-35.8.8.tgz","hashes":{"sha1":"fe3f793fca8b84c0e37d0340b041fad3a62ab7c2","sha512_sri":"sha512-8gvYps/QQ5RRapS9SmUKlToHKAq0eXM+7G3EoB9Gvy8dx0tXNtiJ1Ct3oPFDmW3Kec1gG2kCuoknxp87/RuCPw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-legal/MAL-2026-12577.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}