MAL-2026-12543

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-base-analytics-data/MAL-2026-12543.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12543
Published
2026-08-05T14:16:04Z
Modified
2026-08-05T14:35:09.137628363Z
Summary
Malicious code in checkout-base-analytics-data (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa)

On require of the package's main (index.js), the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an unverified binary over HTTPS from hostnames assembled at runtime via string-array concatenation (oob-worker.cf101-adf.workers.dev and sibling *.workers.dev endpoints, with a DNS-TXT chunked fallback via *.wel1.ru subdomains including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the bytes to /var/tmp or %TEMP% under disguised names such as.cache<hex> and dotnetdiag<hex>.exe, chmods the file to 0755, and spawns it detached via /bin/sh or cmd. Endpoint hostnames are split into fragments and reassembled with Array.join to defeat static URL/domain matching, and index.js loads _polyfill unconditionally inside a try/catch so import failure is silenced. The package's declared purpose (a generic 'analytics data runtime support module') and empty dependency list are inconsistent with any legitimate need for a hidden native-binary loader fetching from unrelated *.workers.dev hosts.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa",
            "id": "IN-MAL-2026-015232",
            "modified_time": "2026-08-05T14:16:04Z",
            "import_time": "2026-08-05T14:20:15.126681964Z",
            "source": "amazon-inspector",
            "versions": [
                "35.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-base-analytics-data

Package

Name
checkout-base-analytics-data
View open source insights on deps.dev
Purl
pkg:npm/checkout-base-analytics-data

Affected ranges

Affected versions

35.*
35.9.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "e9ba856166eb81c4dfb356ae53a0841f657901aa90b2edf922cedbed145b288b",
            "path": "_polyfill.js",
            "tlsh": "f9a1875a16aa70198bb0e7f4c7175819f65af6733380c188f75c69944f7712882b2efc"
        },
        {
            "sha256": "c80de6847f4e6e7ebdc6a8f5a185fd659f3ab2624503192657a18920ba9cc24d",
            "path": "package.json",
            "tlsh": "9fd0a7111850702304be67929ca145067b620f2f2674cc0b21776268215067324ef326"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-hNIqZyDffLcK5s8GvdAq30yDQBkjncZjSZYZapkPd7MwqMjCW+sqQ8sykCQLbtAn+oGuaR6HupMUIse52MUB/w==",
                "sha1": "df742fe4e5a1c83ca9974741c8b33c16678a4638"
            },
            "filename": "checkout-base-analytics-data-35.9.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-base-analytics-data/MAL-2026-12543.json"