MAL-2026-12549

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-confirm-pos-order-sms-am/MAL-2026-12549.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12549
Published
2026-08-05T14:13:56Z
Modified
2026-08-05T14:35:18.945033593Z
Summary
Malicious code in checkout-confirm-pos-order-sms-am (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e)

On require() of this package, index.js loads _init.js which invokes init() immediately. init() downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via split-join of small string fragments to evade static scanners. A DNS-TXT fallback reassembles the payload from base64 chunks served under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix or dotnet_diag_<hex>.exe on Windows mimicking a.NET diagnostic tool), chmod 0755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe; the spawn is unref()'d so it outlives the Node process. Execution is throttled by a /tmp cooldown file. The tarball also ships lib/telemetry.js (~81 KB, framed with 'Analytics SDK' comments) containing an equivalent dropper: split require('child_'+'process'), base64 chunk assembly, fs['chmod'+'Sync'](path, 0o755), and cp.spawn('/bin/sh', ['-c', filePath+' &']). The require('child_process'), fs.chmodSync, and spawn identifiers are string-split throughout to hide from keyword scanners. Package name lookalike of a checkout/POS SMS confirmation utility. Installing or requiring this package executes attacker-controlled native code on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e",
            "id": "IN-MAL-2026-015218",
            "modified_time": "2026-08-05T14:13:56Z",
            "import_time": "2026-08-05T14:20:13.848038512Z",
            "source": "amazon-inspector",
            "versions": [
                "35.6.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-confirm-pos-order-sms-am

Package

Name
checkout-confirm-pos-order-sms-am
View open source insights on deps.dev
Purl
pkg:npm/checkout-confirm-pos-order-sms-am

Affected ranges

Affected versions

35.*
35.6.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "0236d6ca15406ecb3ef59da2579077e1c417ae3d9b148b88cf53ba91eea808ce",
            "path": "_init.js",
            "tlsh": "dba1a76a16a670084b70dbe5c7175826f657fa6333808598fb5c99884fb252483f2efc"
        },
        {
            "sha256": "4f958518bbfdb7d726957cad0d16e1daab0143042c093ae509d1f44cb03f16c0",
            "path": "lib/telemetry.js",
            "tlsh": "b3835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-AH9KMSkdJ5/oJoHDaUqV6mbWQI4ED3CFPfK9aJb2efZdg7/2/81dOBuW6eGsfpwh3yUmqu50wSSON1DZ6TndbQ==",
                "sha1": "e7f9ba78cb07b4a65f54f8d1d8c5b0d9bf547c9a"
            },
            "filename": "checkout-confirm-pos-order-sms-am-35.6.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-confirm-pos-order-sms-am/MAL-2026-12549.json"