MAL-2026-12572

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-bnpl/MAL-2026-12572.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12572
Published
2026-08-05T14:10:59Z
Modified
2026-08-05T14:35:29.663337456Z
Summary
Malicious code in checkout-mobile-bnpl (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f)

index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) from split-string fragments, plus a DNS-TXT fallback channel under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru that reassembles base64 chunks retrieved via resolveTxt. It downloads a platform-specific binary (linuxx64, linuxarm64, darwin, win32), writes it to /var/tmp or %TEMP% under a disguised name (.cache<hex> or dotnetdiag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start, with an mtime stamp to gate repeat execution. lib/telemetry.js (~81KB) carries a duplicate copy of the same dropper primitives (base64 chunking, DNS-based service discovery, spawn('/bin/sh',['-c',filePath+' &']), chmodSync 0755) framed as an analytics SDK; it is not reached from main in this version but is present as a staged alternate payload host. Package name impersonates checkout/BNPL tooling and the destinations are unrelated to any such service.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f",
            "id": "IN-MAL-2026-015198",
            "modified_time": "2026-08-05T14:10:59Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:12.078239407Z",
            "versions": [
                "35.6.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-mobile-bnpl

Package

Name
checkout-mobile-bnpl
View open source insights on deps.dev
Purl
pkg:npm/checkout-mobile-bnpl

Affected ranges

Affected versions

35.*
35.6.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "94ef6b1c4a9d31f78f446d053048bcef34fd88f4376a1a46f7f777a9e9c83a29",
            "path": "_helpers.js",
            "tlsh": "1aa1629a16ba71094bb09be1c6174416fa5bf6633780c294fb9ca5841fb31248371efc"
        },
        {
            "sha256": "a3e2ffb440b779d30da3ff282affd649731088e8570df7b1aa72742d995b782c",
            "path": "lib/telemetry.js",
            "tlsh": "f5835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-GzLHh2R6VbEqeZxGfUskKTOZM+mgOwDVktknFvkz3DAmJ842udhSiSp5TAxSSJZznSbRkJhfPmtZCAkwsiixhg==",
                "sha1": "0b09034f28ffe25b78f5a8363a77864d8bf6ffe0"
            },
            "filename": "checkout-mobile-bnpl-35.6.9.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-bnpl/MAL-2026-12572.json"