{"id":"MAL-2026-12585","summary":"Malicious code in checkout-pay-widget-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f)\nOn require('checkout-pay-widget-logic'), index.js loads./_vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf*.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru that reassembles base64 chunks from TXT records. C2 hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched binary is written to /tmp or %TEMP% under disguised names (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows, mimicking a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A lock file named.analytics_state and 'telemetry'-labeled functions provide a cover story; the package's stated purpose is a 'log formatter'. Environment-variable opt-outs exist but the dropper runs by default.\n","modified":"2026-08-05T14:35:36.031607459Z","published":"2026-08-05T14:09:46Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015190","import_time":"2026-08-05T14:20:11.33773427Z","modified_time":"2026-08-05T14:09:46Z","sha256":"3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f","source":"amazon-inspector","versions":["35.3.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-pay-widget-logic/v/35.3.2"}],"affected":[{"package":{"name":"checkout-pay-widget-logic","ecosystem":"npm","purl":"pkg:npm/checkout-pay-widget-logic"},"versions":["35.3.2"],"database_specific":{"indicators":{"package_integrity":[{"filename":"checkout-pay-widget-logic-35.3.2.tgz","hashes":{"sha1":"7f1c334e873fabe4fea1a537febef6e18747765b","sha512_sri":"sha512-VlHYX48pS438qK1rx/aBmz2o7/MpIGj8dizYjPRQVXXM7X8o0fX3lkBS7V65PYmf9X3f5GJhtANCdMn3it6mmw=="}}],"evidence_files":[{"tlsh":"89a1859a217671094bb0d7e0cb175416f66bf6a33380c598fa5ca5944f7612883b1efc","path":"_vendor.js","sha256":"c0b79fa22ec08ba2eb3049697964d89fa752e6bc4c08e0b88226e941bf2dada4"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-pay-widget-logic/MAL-2026-12585.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}