MAL-2026-12588

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-promocode-logic/MAL-2026-12588.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12588

Published

2026-08-05T14:08:13Z

Modified

2026-08-05T14:35:37.831200866Z

Summary

Malicious code in checkout-promocode-logic (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c1d75e7966f60937203bdc9f6ee1a90e58fbf046f76ec5aa0b4d68018fce4f87)

On require, index.js loads ext.js which selects a per-OS payload path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT covert-channel fallback that reassembles base64 chunks from TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /var/tmp/.cache<rand> (or %TEMP%\dotnetdiag<rand>.exe on Windows), chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe /c start /b. Destination hosts, DNS fallback zones, the childprocess module name, and dropped file names are all assembled from split string fragments at runtime, and the dropped file is named to masquerade as a.NET diagnostic or telemetry artifact. lib/telemetry.js ships the same dropper primitives with stronger evasion (require("child" + "process"), fs["chmod" + "Sync"], base64-chunk reassembly).

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "c1d75e7966f60937203bdc9f6ee1a90e58fbf046f76ec5aa0b4d68018fce4f87",
            "id": "IN-MAL-2026-015179",
            "modified_time": "2026-08-05T14:08:13Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:10.113088606Z",
            "versions": [
                "35.7.7"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/checkout-promocode-logic/v/35.7.7

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / checkout-promocode-logic

Package

Name: checkout-promocode-logic; View open source insights on deps.dev
Purl: pkg:npm/checkout-promocode-logic

Affected ranges

Affected versions

35.*

35.7.7

Database specific

indicators

{
    "evidence_files": [
        {
            "sha256": "844c9e2b0312925d5bd592bbe9bb6160d7066da6af4fa2fcd6acfeb3580703c6",
            "path": "_ext.js",
            "tlsh": "2aa1879a166670184bb0dbe4c7275415f65bf6633780c288fb9c99984fb712482b2efc"
        },
        {
            "sha256": "2dc502fc017b5b6bc7dc3c484d0f79dfc20d9c1a98333b7a5e8f9f6d323dbca9",
            "path": "lib/telemetry.js",
            "tlsh": "e0835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-jPXLktqsyWj6lixs2ijMA16qczghLKls+EaeAc2LWBr7/iZdCJJEdxJyPUKcUfsSdF8iOCSIbjvzIv5CaRBjAQ==",
                "sha1": "b78bf6549ce691b7861cc30e0a988336a4ecb5ed"
            },
            "filename": "checkout-promocode-logic-35.7.7.tgz"
        }
    ]
}

cwes

[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-promocode-logic/MAL-2026-12588.json"