MAL-2026-12581

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-molecule-desktop-status-modal/MAL-2026-12581.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12581
Published
2026-08-05T14:10:35Z
Modified
2026-08-05T14:35:34Z
Summary
Malicious code in checkout-molecule-desktop-status-modal (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247)

The package's main entry (index.js) requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from character-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) and a DNS-fallback discovery domain (sdk.dl.wel1.ru), downloads a platform-specific native binary via HTTPS from those hosts (with a chunked base64 DNS TXT transport as fallback when HTTPS is blocked), writes the bytes to /var/tmp or %TEMP% under disguised names such as.cache/dotnet_diag, chmods 0755, and detaches a background process via spawn("/bin/sh", ["-c", path + " &"], {detached:true}).unref() or cmd.exe /c start. A local.analytics_state marker throttles reruns. A second module, lib/telemetry.js, ships the same write-chmod-exec primitives with dynamic-string API name assembly ("child_"+"process", "chmod"+"Sync") behind an APM/telemetry cover. The advertised purpose of the package is a UI status-modal helper, which has no need to fetch and execute native binaries from anonymous workers.dev subdomains at require() time; there is no hash or signature verification on the downloaded payload.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-015195",
            "import_time":  "2026-08-05T14:20:11.79349722Z",
            "modified_time":  "2026-08-05T14:10:35Z",
            "sha256":  "be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247",
            "source":  "amazon-inspector",
            "versions":  [
                "35.9.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-molecule-desktop-status-modal

Package

Name
checkout-molecule-desktop-status-modal
View open source insights on deps.dev
Purl
pkg:npm/checkout-molecule-desktop-status-modal

Affected ranges

Affected versions

35.*
35.9.4

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "_polyfill.js",
            "sha256":  "f60e25ec17f307cb5dfe169da81b8f977334ac32d0a6f2282451670d7991fe7b",
            "tlsh":  "54a1979a11a670188bb0e7f4c7175415f65be6633380c294fb5ca5885fb712883b1dfc"
        },
        {
            "path":  "lib/telemetry.js",
            "sha256":  "ed399840ca88097c7ff055d099b5288635931c5674acea852b816c5ae451d077",
            "tlsh":  "2f835056566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "checkout-molecule-desktop-status-modal-35.9.4.tgz",
            "hashes":  {
                "sha1":  "f30e25c28de943b3202c5bec84b2bb9b094c714a",
                "sha512_sri":  "sha512-tuB+OSQIVxR8eaYZiGvxB4HQxq6F+c312/dOYXcDJ06JusVGnZmtcWmV1gp/vr5nLFyoTWQtzUJ+nj+VcdoHjg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-molecule-desktop-status-modal/MAL-2026-12581.json"