MAL-2026-12576

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-input-email/MAL-2026-12576.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12576
Published
2026-08-05T14:11:10Z
Modified
2026-08-05T14:35:31.857368257Z
Summary
Malicious code in checkout-mobile-input-email (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372)

On require('checkout-mobile-input-email'), index.js loads helpers.js which assembles hostnames via string-array.join("") (e.g. ["oob-worker.cf103-070.workers.","dev"].join(""), ["oob-","worker.cf102-baf.workers.d","ev"].join(""), and ['sdk.dl.wel1.','ru'].join("")) to reach oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, and DNS-TXT fallback resolvers under *.dl.wel1.ru. A platform-specific binary is downloaded, written to /tmp or %TEMP% under disguised names (.cache<hex>,.analyticsstate, dotnetdiag_<hex>.exe), chmod'd 0755, and spawned detached via spawn("/bin/sh",...) with fp+' &' or via cmd.exe /c start /b at _helpers.js line 121-139. Destination hostnames are anonymous Cloudflare Workers subdomains unrelated to any legitimate 'checkout mobile input email' functionality; the base64/DNS-TXT fallback resolver path constitutes a secondary exfil/download channel. A large sibling bundle lib/telemetry.js (~81 KB) ships in the tarball but is not require()'d from the traced modules; the executed native binary may reference or replace it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372",
            "id": "IN-MAL-2026-015199",
            "modified_time": "2026-08-05T14:11:10Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:12.169842939Z",
            "versions": [
                "35.6.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-mobile-input-email

Package

Name
checkout-mobile-input-email
View open source insights on deps.dev
Purl
pkg:npm/checkout-mobile-input-email

Affected ranges

Affected versions

35.*
35.6.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "358a685fad8ae74146d82edea667281de909cc794a721fbf5a87602a52e0ad60",
            "path": "_helpers.js",
            "tlsh": "4ca1955a16aa30198bb0d7e4c7274416f65ee6a33780c2c8fb9ca5945f72524c3b2dfc"
        },
        {
            "sha256": "becf8c44324f8b012efd2c518d31fff20312fbbd13865b5362f7c18971d7cff3",
            "path": "lib/telemetry.js",
            "tlsh": "28835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-vbLIe1VAQs7oVeHHNrGleXPRIk7h3zRgAumTf6lqvmcNsS/8u12iBR1cmu9Dqox0W5DZPIy8G1cLr+eOdiiFGw==",
                "sha1": "03b1a97921d64c2bbd26e1f1d63cb57f743f5909"
            },
            "filename": "checkout-mobile-input-email-35.6.8.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-mobile-input-email/MAL-2026-12576.json"