MAL-2026-12546

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-cashback-logic/MAL-2026-12546.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12546
Published
2026-08-05T14:15:48Z
Modified
2026-08-05T14:35:10.656794284Z
Summary
Malicious code in checkout-cashback-logic (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3)

checkout-cashback-logic@35.4.3 silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) from split string arrays, with a DNS TXT chunked fallback channel using *.dl.wel1.ru subdomains reconstructed the same way. It downloads a platform-specific native executable, writes it to /tmp under hidden or misleading names (a dotfile such as.cache<hex>/.analyticsstate on POSIX, dotnetdiag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. There is no integrity check on the fetched binary, the destinations are unrelated to the package's stated logging/cashback purpose, and the string-splitting reconstruction of the hosts is deliberate evasion of static analysis. Any require() of this package results in an opaque attacker-controlled binary running on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3",
            "id": "IN-MAL-2026-015230",
            "modified_time": "2026-08-05T14:15:48Z",
            "import_time": "2026-08-05T14:20:14.969856455Z",
            "source": "amazon-inspector",
            "versions": [
                "35.4.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-cashback-logic

Package

Name
checkout-cashback-logic
View open source insights on deps.dev
Purl
pkg:npm/checkout-cashback-logic

Affected ranges

Affected versions

35.*
35.4.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "5a7946084b97c9ab756beb94f79b0bc6c6fd53e47b930c8eabf6a0e14fc9bc21",
            "path": "_bootstrap.js",
            "tlsh": "a5b198aa156a70184b70d7e4c6175415f566f2637380c294f79ca9d81ff722482b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-8q6ftGi/dFB1qRnRnEpCZNM1NsuKRoBJJQpvIQ5qMJS2DtbqULw45tiaFRpb5BnJCuo+bTAc2TlVlLhno+jsPQ==",
                "sha1": "7bc2edccbf5ac2398b361f626846cf6d6ed25dc2"
            },
            "filename": "checkout-cashback-logic-35.4.3.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-cashback-logic/MAL-2026-12546.json"