{"id":"MAL-2026-12590","summary":"Malicious code in checkout-resend-pos-order-sms-am (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11)\nOn require() of this package, index.js loads _polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation (e.g. 'oob-worker.cf10x-*.workers.dev' variants) and issues an https.get to download a platform-specific executable. The bytes are written to /var/tmp/.cache_\u003crnd\u003e on Unix or %TEMP%\\dotnet_diag_\u003crnd\u003e.exe on Windows, chmodded to 0755, and spawned detached via spawn('/bin/sh', ['-c', \u003cpath\u003e + ' &']) or the Windows equivalent. A DNS-TXT base64-chunk fallback via *.dl.wel1.ru resolvers is used when direct HTTPS fetch fails. The child_process module reference and 'chmodSync' string are also concatenated at runtime ('child_'+'process', 'chmod'+'Sync') to defeat static string matching. A sibling module lib/telemetry.js contains the same fetch/chmod-0755/sh-c-spawn dropper pattern, indicating shared payload infrastructure. The package's stated purpose (an SMS/POS order helper) is unrelated to downloading and executing native binaries from Cloudflare Workers subdomains, and the disguised on-disk filenames (.cache_*, dotnet_diag_*.exe) further indicate concealment rather than legitimate runtime setup.\n","modified":"2026-08-05T14:35:39.064971220Z","published":"2026-08-05T14:08:41Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:20:10.518889894Z","modified_time":"2026-08-05T14:08:41Z","sha256":"67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11","source":"amazon-inspector","versions":["35.3.3"],"id":"IN-MAL-2026-015183"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-resend-pos-order-sms-am/v/35.3.3"}],"affected":[{"package":{"name":"checkout-resend-pos-order-sms-am","ecosystem":"npm","purl":"pkg:npm/checkout-resend-pos-order-sms-am"},"versions":["35.3.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"4bece4df171118308a7394fb35e5daa2eef40455de7e356ea199784731251984","tlsh":"62a1969a066a701d4bb0abf4c61b441af65af6633280c194fb5ca9985f73514c3b2efc"},{"tlsh":"4c835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbdb2092a5ffc","path":"lib/telemetry.js","sha256":"faafc7b0651b1fe4174843149b850f88a102ffac01831b2188830b0eaf6dc3b5"}],"package_integrity":[{"hashes":{"sha1":"b1bce72ff4be9448db5a68e105dce2ee913492d9","sha512_sri":"sha512-ZefcnBsHpxXOrAtskbkKcP6HMzoQUx6CvplDBTvy3xDVB4RWeu/smKsDHuCc7CZwx+8TZ/Hh5haTzXjdbhMnpA=="},"filename":"checkout-resend-pos-order-sms-am-35.3.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-resend-pos-order-sms-am/MAL-2026-12590.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}