MAL-2026-12545

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-bnpl-logic/MAL-2026-12545.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12545
Published
2026-08-05T14:15:08Z
Modified
2026-08-05T14:35:10.301354965Z
Summary
Malicious code in checkout-bnpl-logic (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e)

The package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with require("./_polyfill"), which runs on every consumer import. polyfill.js reassembles hostnames from string arrays at runtime, fetches a platform-specific binary from anonymous Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a base64-over-DNS-TXT fallback channel through *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru), writes the opaque bytes to a hidden temp path (/tmp/.cache<hex> or %TEMP%/dotnetdiag<hex>.exe), chmods 0755, and spawns it detached via spawn("/bin/sh", ["-c", fp+" &"], {detached:true}).unref() (or the cmd equivalent on Windows), with stderr silenced. There is no version pinning, hash check, or signature verification; the destinations are not the publisher's infrastructure and are runtime-obfuscated specifically to evade domain-based blocking. The Logger class is a decoy facade; the sole effect of importing this package is to drop and execute an attacker-controlled binary on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:15:08Z",
            "id": "IN-MAL-2026-015226",
            "import_time": "2026-08-05T14:20:14.63843203Z",
            "sha256": "cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e",
            "versions": [
                "35.9.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-bnpl-logic

Package

Name
checkout-bnpl-logic
View open source insights on deps.dev
Purl
pkg:npm/checkout-bnpl-logic

Affected ranges

Affected versions

35.*
35.9.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "checkout-bnpl-logic-35.9.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-ii3zNoOWKXizajPPxS3SOdgFmgPMe/1lyTXEPTnfTJSmiPJ4OzhH5bVYYPtloOKZeblzXABuOwwcoDvqVSHtIQ==",
                "sha1": "37b9b29d651921c6024424121f0676868530658a"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "92b1b89a166a701987b097e4c72b5416f65bf663338092d4fb6c95980fb31248372efc",
            "sha256": "cc00f4cf3d5b86e954ea6703a29b29798180cb9c74b68354f13773eb553428d8",
            "path": "_polyfill.js"
        },
        {
            "tlsh": "6c119b6267ed16475172a364cde380037a2ad29ea853b2dc734c53fe0fbd5581625e32",
            "sha256": "3918e4317632da3f118859ef6899963cb2a53356e3d534170b0ad077aceb5ef6",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-bnpl-logic/MAL-2026-12545.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]