MAL-2026-12573

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-cashback/MAL-2026-12573.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12573
Published
2026-08-05T14:11:19Z
Modified
2026-08-05T14:35:30.328099640Z
Summary
Malicious code in checkout-mobile-cashback (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4)

checkout-mobile-cashback@35.4.9 executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary URL from a hardcoded list of Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) assembled via array-join string splitting to evade static matching, with a DNS-TXT chunked base64 fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names imitating system tooling (.cache<rand>, dotnetdiag<rand>.exe), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed, the destinations are unrelated to any declared publisher, and the logging function is stubbed to a no-op while a DISABLE_TELEMETRY env-var opt-out provides a telemetry cover story. The behavior fires as a side effect of importing the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4",
            "id": "IN-MAL-2026-015200",
            "modified_time": "2026-08-05T14:11:19Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:12.265920444Z",
            "versions": [
                "35.4.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-mobile-cashback

Package

Name
checkout-mobile-cashback
View open source insights on deps.dev
Purl
pkg:npm/checkout-mobile-cashback

Affected ranges

Affected versions

35.*
35.4.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "3f53342f6f459d855a14dac3a35e52f4329296a9ac8f2129aa175f6c01b9f3dd",
            "path": "_shim.js",
            "tlsh": "92b1746616aa30194bb0ebe4c6175416f65bf6633380c284fa5c69885fb3564c3b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1LYdQg/7XuB+niOwAXACc9r0rwAFFCa9vdlwf7suljOZ0frN0Qnpj5NXH9Z6uqhQKyNXJMRJNPvLhSn2Mq1Spg==",
                "sha1": "4e8c853eedf948aa766d5e4d364169b4ae09d0e1"
            },
            "filename": "checkout-mobile-cashback-35.4.9.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-cashback/MAL-2026-12573.json"