{"id":"MAL-2026-12591","summary":"Malicious code in checkout-select-pos-offer-am (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008)\nindex.js unconditionally requires _ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised filenames (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmods it to 0755, and detach-spawns it via `/bin/sh -c` or `cmd.exe /c start /b`. Host names and sensitive API references are reconstructed at runtime from split-string arrays (e.g. host strings assembled via.join('') and `require('child_' + 'process')`, `fs['chmod' + 'Sync']`) to evade static analysis, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks are used as cover-story naming. lib/telemetry.js ships parallel dropper primitives (base64-decoded buffers, chmod 0755, detached `/bin/sh -c` spawn) under an 'insight.node' analytics SDK disguise. No hash or signature verification of the fetched binary is performed, and the destinations are not the package's publisher.\n","modified":"2026-08-05T14:35:39.147293005Z","published":"2026-08-05T14:08:05Z","database_specific":{"malicious-packages-origins":[{"sha256":"25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008","source":"amazon-inspector","versions":["35.2.7"],"id":"IN-MAL-2026-015178","import_time":"2026-08-05T14:20:09.993258374Z","modified_time":"2026-08-05T14:08:05Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-select-pos-offer-am/v/35.2.7"}],"affected":[{"package":{"name":"checkout-select-pos-offer-am","ecosystem":"npm","purl":"pkg:npm/checkout-select-pos-offer-am"},"versions":["35.2.7"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-OwL/Cbicca+SagH8etwXpTEWGncCtQIODU1CFIbv4pHjjQ2o3okEfVXsahZoYds+gDHA8revOyruiJyn5QxJGw==","sha1":"f04ee593b48534390b21408e71d6ccba10c7a91b"},"filename":"checkout-select-pos-offer-am-35.2.7.tgz"}],"evidence_files":[{"path":"_ext.js","sha256":"15a97dbc7588c60b44d342012da1d3ae92f1fd5cf4872c9f2c4cb862c40d1baa","tlsh":"67a1a75b12aa70184bb0ebe4c6174816f65af6633781c1d8fb9c55981f7312483b2efc"},{"path":"lib/telemetry.js","sha256":"ac51a91486b6771cfa8e655c1bf9eb6b85d6b15e1bea71e396ef06fc9263f9ae","tlsh":"9b835055566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-select-pos-offer-am/MAL-2026-12591.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}