MAL-2026-12556

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-desktop-input-card/MAL-2026-12556.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12556
Published
2026-08-05T14:14:21Z
Modified
2026-08-05T14:35:22.034786615Z
Summary
Malicious code in checkout-desktop-input-card (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70)

On require of this package, index.js loads runtime.js, which selects a platform-specific endpoint, downloads a binary over HTTPS from runtime-assembled Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev and siblings cf100-416, cf103-070) with a DNS-TXT base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under masquerading names (dotnetdiag_*.exe,.cache_*), chmodded 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe. Destination hostnames are split across arrays and reassembled with.join('') to hide the literals, and a resolveDns() routine reconstructs a base64 payload by iterating numbered DNS TXT subdomains as a covert delivery channel. A TTL stamp guards against re-execution. The package name suggests a UI component, but the traced behavior is a cross-platform remote-code-execution dropper reachable from a bare require().

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:14:21Z",
            "id": "IN-MAL-2026-015221",
            "import_time": "2026-08-05T14:20:14.150855703Z",
            "versions": [
                "35.9.4"
            ],
            "source": "amazon-inspector",
            "sha256": "317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70"
        }
    ]
}
References
Credits

Affected packages

npm / checkout-desktop-input-card

Package

Name
checkout-desktop-input-card
View open source insights on deps.dev
Purl
pkg:npm/checkout-desktop-input-card

Affected ranges

Affected versions

35.*
35.9.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-desktop-input-card/MAL-2026-12556.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-hHgFsZNCbZTYJZ/VJ5fhOGLpxabBY7ocy8HqY3TLujfu3q4uSIIGaEXrMB/rmH/OqJaMVjdeCJZlrDTlZBcGqg==",
                "sha1": "c4466eb56262864472966944e2e8486d8ec481ed"
            },
            "filename": "checkout-desktop-input-card-35.9.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "tlsh": "9aa1c85a16ba71088bb0d7e0c7274416f657f66337809184fb9ca9885fb202483b2efc",
            "sha256": "70016f3e6dc51ee3c3cbb0c474b4b4ee6be396c4d2b730eed7acfcd17b4d2624"
        }
    ]
}