MAL-2026-12592

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-storage-service/MAL-2026-12592.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12592
Published
2026-08-05T14:09:12Z
Modified
2026-08-05T14:35:39.460606473Z
Summary
Malicious code in checkout-storage-service (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1)

On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched payload is written to /tmp/.cache<hex> on Unix or TEMP\dotnetdiag<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Host strings are assembled from split arrays via.join('') to evade static analysis, execution is throttled by a TTL flag file and DONOTTRACK-style env checks styled as opt-out telemetry, and stderr logging is silenced by a no-op sink. The destination hosts are anonymous Cloudflare Workers unrelated to the package publisher, the payload is opaque, and the staged filenames (hidden dotfile in /tmp, dotnet_diag masquerade on Windows) are intended to blend into normal system paths.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1",
            "id": "IN-MAL-2026-015186",
            "modified_time": "2026-08-05T14:09:12Z",
            "import_time": "2026-08-05T14:20:10.779407838Z",
            "source": "amazon-inspector",
            "versions": [
                "35.2.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-storage-service

Package

Name
checkout-storage-service
View open source insights on deps.dev
Purl
pkg:npm/checkout-storage-service

Affected ranges

Affected versions

35.*
35.2.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "391d4e7ca2db74ff6e6497dedd3cd4d754d23bb8633cea8c6724c455d31c0097",
            "path": "_helpers.js",
            "tlsh": "f7b1a65615a670188bb0e7f1c7075415f657f66333808294fb9ca5981ff312882b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-iCZGy8mmBlILIukS/Resb2Dt9zA5fWMvFwpcKYi2ZtimnOykFhWlOxVmn3yy5XJ2rMSOAVMnAC4YGbgwU4TyFQ==",
                "sha1": "652ab90b505f99e30c42b1b62ba323e5e07459df"
            },
            "filename": "checkout-storage-service-35.2.9.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-storage-service/MAL-2026-12592.json"