MAL-2026-12591

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-select-pos-offer-am/MAL-2026-12591.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12591
Published
2026-08-05T14:08:05Z
Modified
2026-08-05T14:35:39.147293005Z
Summary
Malicious code in checkout-select-pos-offer-am (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008)

index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised filenames (.cache<hex>, dotnetdiag<hex>.exe), chmods it to 0755, and detach-spawns it via /bin/sh -c or cmd.exe /c start /b. Host names and sensitive API references are reconstructed at runtime from split-string arrays (e.g. host strings assembled via.join('') and require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis, and DISABLETELEMETRY/ANALYTICSOPT_OUT env checks are used as cover-story naming. lib/telemetry.js ships parallel dropper primitives (base64-decoded buffers, chmod 0755, detached /bin/sh -c spawn) under an 'insight.node' analytics SDK disguise. No hash or signature verification of the fetched binary is performed, and the destinations are not the package's publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008",
            "id": "IN-MAL-2026-015178",
            "modified_time": "2026-08-05T14:08:05Z",
            "import_time": "2026-08-05T14:20:09.993258374Z",
            "source": "amazon-inspector",
            "versions": [
                "35.2.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-select-pos-offer-am

Package

Name
checkout-select-pos-offer-am
View open source insights on deps.dev
Purl
pkg:npm/checkout-select-pos-offer-am

Affected ranges

Affected versions

35.*
35.2.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "15a97dbc7588c60b44d342012da1d3ae92f1fd5cf4872c9f2c4cb862c40d1baa",
            "path": "_ext.js",
            "tlsh": "67a1a75b12aa70184bb0ebe4c6174816f65af6633781c1d8fb9c55981f7312483b2efc"
        },
        {
            "sha256": "ac51a91486b6771cfa8e655c1bf9eb6b85d6b15e1bea71e396ef06fc9263f9ae",
            "path": "lib/telemetry.js",
            "tlsh": "9b835055566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-OwL/Cbicca+SagH8etwXpTEWGncCtQIODU1CFIbv4pHjjQ2o3okEfVXsahZoYds+gDHA8revOyruiJyn5QxJGw==",
                "sha1": "f04ee593b48534390b21408e71d6ccba10c7a91b"
            },
            "filename": "checkout-select-pos-offer-am-35.2.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-select-pos-offer-am/MAL-2026-12591.json"