MAL-2026-12563

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-format-money/MAL-2026-12563.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12563
Published
2026-08-05T14:11:43Z
Modified
2026-08-05T14:35:25.518964025Z
Summary
Malicious code in checkout-format-money (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224)

checkout-format-money@35.8.6 executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js reconstructs destination hostnames from split string arrays (e.g. 'oob-worker.cf101-adf'+'.wor'+'kers.de'+'v') and DNS-TXT discovery domains under a fallback of the form sdk/ext/pkg/net.dl.wel1.ru, fetches an opaque binary over https.get, writes it to /tmp or %TEMP% under disguised names such as.cache<hex> or dotnetdiag_<hex>.exe, sets it executable with fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',...) on Windows. A secondary loader with the same shape is bundled in lib/telemetry.js: base64-decoded bytes written to disk, fs'chmod'+'Sync', and cp.spawn('/bin/sh', ['-c', filePath+' &']). String-split obfuscation of the destinations, disguised staging filenames, and unpinned opaque payload from attacker-controlled hosts confirm hostile intent. Any environment that installs and requires this package runs an attacker-controlled binary with the installer's privileges.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224",
            "id": "IN-MAL-2026-015203",
            "modified_time": "2026-08-05T14:11:43Z",
            "import_time": "2026-08-05T14:20:12.55002146Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-format-money

Package

Name
checkout-format-money
View open source insights on deps.dev
Purl
pkg:npm/checkout-format-money

Affected ranges

Affected versions

35.*
35.8.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "beba40e696041431b5735d249a4fdd2b57c38ffbd13c10a241cbb95bda3160a6",
            "path": "setup.js",
            "tlsh": "7ca1959a15aa70194bb0a7e0c7175419f65af6633380c298f79ca9881f72534c3b2efc"
        },
        {
            "sha256": "9912ab556c0ded406631dc8c9b78f7002dc1189d8bd8aadb397812bb6ff4f0e6",
            "path": "lib/telemetry.js",
            "tlsh": "a4835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-OINlWUEHfKSX8XxIlcNE4Y5+CyI63tyxuouFUmsh9MhZUeV2GH2+Qye16llVPKx56k/BoWEDggYoDUQCcVB3OQ==",
                "sha1": "ffe42fe668e85b91459fbf3d2aae197ac1f8ec57"
            },
            "filename": "checkout-format-money-35.8.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-format-money/MAL-2026-12563.json"