MAL-2026-12581

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-molecule-desktop-status-modal/MAL-2026-12581.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12581
Published
2026-08-05T14:10:35Z
Modified
2026-08-05T14:35:34.446880931Z
Summary
Malicious code in checkout-molecule-desktop-status-modal (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247)

The package's main entry (index.js) requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from character-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) and a DNS-fallback discovery domain (sdk.dl.wel1.ru), downloads a platform-specific native binary via HTTPS from those hosts (with a chunked base64 DNS TXT transport as fallback when HTTPS is blocked), writes the bytes to /var/tmp or %TEMP% under disguised names such as.cache/dotnetdiag_, chmods 0755, and detaches a background process via spawn("/bin/sh", ["-c", path + " &"], {detached:true}).unref() or cmd.exe /c start. A local.analyticsstate marker throttles reruns. A second module, lib/telemetry.js, ships the same write-chmod-exec primitives with dynamic-string API name assembly ("child"+"process", "chmod"+"Sync") behind an APM/telemetry cover. The advertised purpose of the package is a UI status-modal helper, which has no need to fetch and execute native binaries from anonymous workers.dev subdomains at require() time; there is no hash or signature verification on the downloaded payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247",
            "id": "IN-MAL-2026-015195",
            "modified_time": "2026-08-05T14:10:35Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:11.79349722Z",
            "versions": [
                "35.9.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-molecule-desktop-status-modal

Package

Name
checkout-molecule-desktop-status-modal
View open source insights on deps.dev
Purl
pkg:npm/checkout-molecule-desktop-status-modal

Affected ranges

Affected versions

35.*
35.9.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "f60e25ec17f307cb5dfe169da81b8f977334ac32d0a6f2282451670d7991fe7b",
            "path": "_polyfill.js",
            "tlsh": "54a1979a11a670188bb0e7f4c7175415f65be6633380c294fb5ca5885fb712883b1dfc"
        },
        {
            "sha256": "ed399840ca88097c7ff055d099b5288635931c5674acea852b816c5ae451d077",
            "path": "lib/telemetry.js",
            "tlsh": "2f835056566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-tuB+OSQIVxR8eaYZiGvxB4HQxq6F+c312/dOYXcDJ06JusVGnZmtcWmV1gp/vr5nLFyoTWQtzUJ+nj+VcdoHjg==",
                "sha1": "f30e25c28de943b3202c5bec84b2bb9b094c714a"
            },
            "filename": "checkout-molecule-desktop-status-modal-35.9.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-molecule-desktop-status-modal/MAL-2026-12581.json"