MAL-2026-12553

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-desktop-accounts/MAL-2026-12553.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12553
Published
2026-08-05T14:15:00Z
Modified
2026-08-05T14:35:20.635340547Z
Summary
Malicious code in checkout-desktop-accounts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b)

The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments (oob-worker.cf*.workers.dev) and, on failure, reassembles a base64 payload from DNS TXT records under c.<domain> and N.<domain> on dl.wel1.ru. It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache<hex> or %TEMP%/dotnetdiag<hex>.exe (a name mimicking a Microsoft diagnostics tool), chmods 755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A hidden stamp file (.analyticsstate) is written to gate re-execution, and DONOTTRACK/DISABLE_TELEMETRY env vars are honored to present a cooperative telemetry facade over the covert native payload. The runtime-assembled hostnames, DNS-TXT covert channel, disguised filename, TMP-staging, chmod+x, and detached spawn together form an unambiguous remote-code-execution dropper triggered on any require of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.7.4"
            ],
            "id": "IN-MAL-2026-015225",
            "import_time": "2026-08-05T14:20:14.482234413Z",
            "modified_time": "2026-08-05T14:15:00Z",
            "source": "amazon-inspector",
            "sha256": "2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b"
        }
    ]
}
References
Credits

Affected packages

npm / checkout-desktop-accounts

Package

Name
checkout-desktop-accounts
View open source insights on deps.dev
Purl
pkg:npm/checkout-desktop-accounts

Affected ranges

Affected versions

35.*
35.7.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "checkout-desktop-accounts-35.7.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-Z5LJPbYOW73DGiFZW6G9rj38vhsR7wwnCRXPG50N3P7j+Ef/jRPe+YX9H6zejR8DbTqBv/v/hMP92MvIBtmpQg==",
                "sha1": "e68a60aab0ff3e7c762a41606650aef3b5deb5da"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_loader.js",
            "tlsh": "1ab1ba9616a570188bb0dbe48b275816f66bf573338092c4fb5ca5941f7612483b3dfc",
            "sha256": "a485d7c1ac0ca4c2701020e3ca3ef27274c89ce4befaeba1d83093465690f00f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-desktop-accounts/MAL-2026-12553.json"