MAL-2026-12547

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-checkout-test-block-aff/MAL-2026-12547.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12547
Published
2026-08-05T14:14:12Z
Modified
2026-08-05T14:34:54.088987667Z
Summary
Malicious code in checkout-checkout-test-block-aff (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87)

On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT record fallback channel using sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The destination hosts are reassembled via array-join (e.g. ['oob-worker.cf','101-adf.worke','rs.dev'].join('')) to evade static string scanners. The downloaded payload is written to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows to impersonate a Microsoft diagnostic tool), chmodded 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or cmd. No hash or signature verification is performed despite a cover-story comment claiming a SHA-256 integrity check; a dedup lockfile at /tmp/.analyticsstate gates re-execution. lib/telemetry.js (81 KB, framed as an 'Analytics SDK') replicates the same fetch->base64-decode->write->chmod+x->spawn shell chain, importing childprocess via string concatenation (require('child_'+'process')) to further hide the primitive. Installing or requiring this package yields arbitrary remote code execution on the installer's host from attacker-controlled infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:14:12Z",
            "id": "IN-MAL-2026-015220",
            "import_time": "2026-08-05T14:20:14.051298028Z",
            "versions": [
                "35.9.6"
            ],
            "source": "amazon-inspector",
            "sha256": "ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87"
        }
    ]
}
References
Credits

Affected packages

npm / checkout-checkout-test-block-aff

Package

Name
checkout-checkout-test-block-aff
View open source insights on deps.dev
Purl
pkg:npm/checkout-checkout-test-block-aff

Affected ranges

Affected versions

35.*
35.9.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "checkout-checkout-test-block-aff-35.9.6.tgz",
            "hashes": {
                "sha512_sri": "sha512-BzJB3b6J7tmCSGUYQfJGGZ8tmY+heyHF4zgNxmFytG5la6NM7HqZvR0obQLWlQETswf2mA3CIJpnOD4qxFH+Bw==",
                "sha1": "af68b2054a75fc5ee042ece679388fda4ca416f9"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_loader.js",
            "tlsh": "38b1859a12a560194bb0e7e0c70b8816f65bf6633680c5d4fb9ca5844f73524c3b2efc",
            "sha256": "9694c64cd0725b803f6bdb2f3399e351143bffaf6bd45ce93bcb3725fb6ba889"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "d3835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "27652bf0d3fd878bce0ce2e3fff0b88f1d22e0a79acce84965108448ce97314a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-checkout-test-block-aff/MAL-2026-12547.json"