MAL-2026-12574

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-dolyame/MAL-2026-12574.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12574
Published
2026-08-05T14:11:35Z
Modified
2026-08-05T14:35:30.634145917Z
Summary
Malicious code in checkout-mobile-dolyame (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd)

Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated Cloudflare workers.dev mirrors (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime from split-string fragments joined with.join(''). A fallback delivery channel resolves DNS TXT records under c.<domain> and N.<domain> (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) to reassemble a base64-encoded payload, evading URL/domain filtering. The downloaded bytes are written to /var/tmp or %TEMP% under masqueraded names (.cache<hex> or dotnetdiag<hex>.exe), chmod 0755, then spawned detached via /bin/sh -c '<file> &' or cmd.exe /c start /b with stdio ignored. No hash or signature verification is performed. The name resembles legitimate Dolyame checkout tooling, but the package's only observable behavior on import is downloading and running arbitrary attacker-supplied code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd",
            "id": "IN-MAL-2026-015202",
            "modified_time": "2026-08-05T14:11:35Z",
            "import_time": "2026-08-05T14:20:12.451722408Z",
            "source": "amazon-inspector",
            "versions": [
                "35.7.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-mobile-dolyame

Package

Name
checkout-mobile-dolyame
View open source insights on deps.dev
Purl
pkg:npm/checkout-mobile-dolyame

Affected ranges

Affected versions

35.*
35.7.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "f9fb036bf83b9d49d16bc0db030c26a3f533e67da15efdc7abafe9959481d180",
            "path": "_loader.js",
            "tlsh": "14b1979a16aa70184bb09be4c6174416f65af7633781c588f79c69981fb312482b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-iksIQt9Z+UzS2zqDODKr8HC9SIEFyCiTh6CXzfXZTrt66aUg4cXntcRJxyS83BYhzuGmgdMKjhbI4TynuSWsUw==",
                "sha1": "5f83a835d7ef94726041e7748e86b761ee0ef5b0"
            },
            "filename": "checkout-mobile-dolyame-35.7.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-dolyame/MAL-2026-12574.json"