{"id":"MAL-2026-12581","summary":"Malicious code in checkout-molecule-desktop-status-modal (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247)\nThe package's main entry (index.js) requires./_polyfill on load. _polyfill.js immediately runs an async routine that reconstructs several hostnames from character-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) and a DNS-fallback discovery domain (sdk.dl.wel1.ru), downloads a platform-specific native binary via HTTPS from those hosts (with a chunked base64 DNS TXT transport as fallback when HTTPS is blocked), writes the bytes to /var/tmp or %TEMP% under disguised names such as.cache_/dotnet_diag_, chmods 0755, and detaches a background process via spawn(\"/bin/sh\", [\"-c\", path + \" &\"], {detached:true}).unref() or cmd.exe /c start. A local.analytics_state marker throttles reruns. A second module, lib/telemetry.js, ships the same write-chmod-exec primitives with dynamic-string API name assembly (\"child_\"+\"process\", \"chmod\"+\"Sync\") behind an APM/telemetry cover. The advertised purpose of the package is a UI status-modal helper, which has no need to fetch and execute native binaries from anonymous workers.dev subdomains at require() time; there is no hash or signature verification on the downloaded payload.\n","modified":"2026-08-05T14:35:34.446880931Z","published":"2026-08-05T14:10:35Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.9.4"],"id":"IN-MAL-2026-015195","import_time":"2026-08-05T14:20:11.79349722Z","modified_time":"2026-08-05T14:10:35Z","sha256":"be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-molecule-desktop-status-modal/v/35.9.4"}],"affected":[{"package":{"name":"checkout-molecule-desktop-status-modal","ecosystem":"npm","purl":"pkg:npm/checkout-molecule-desktop-status-modal"},"versions":["35.9.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"checkout-molecule-desktop-status-modal-35.9.4.tgz","hashes":{"sha1":"f30e25c28de943b3202c5bec84b2bb9b094c714a","sha512_sri":"sha512-tuB+OSQIVxR8eaYZiGvxB4HQxq6F+c312/dOYXcDJ06JusVGnZmtcWmV1gp/vr5nLFyoTWQtzUJ+nj+VcdoHjg=="}}],"evidence_files":[{"sha256":"f60e25ec17f307cb5dfe169da81b8f977334ac32d0a6f2282451670d7991fe7b","tlsh":"54a1979a11a670188bb0e7f4c7175415f65be6633380c294fb5ca5885fb712883b1dfc","path":"_polyfill.js"},{"tlsh":"2f835056566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"ed399840ca88097c7ff055d099b5288635931c5674acea852b816c5ae451d077"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-molecule-desktop-status-modal/MAL-2026-12581.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}