MAL-2026-12593

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-storybook-default/MAL-2026-12593.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12593
Published
2026-08-05T14:08:21Z
Modified
2026-08-05T14:35:40.320608071Z
Summary
Malicious code in checkout-storybook-default (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909)

On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays (e.g. oob-worker.cf10{0-3}-*.workers.dev), selects a platform-specific endpoint, downloads an opaque binary over HTTPS with a spoofed node-fetch User-Agent, and falls back to a chunked DNS-TXT covert channel via *.dl.wel1.ru hosts (e.g. sdk.dl.wel1.ru). The payload is written to a hidden cache path under /tmp or %TEMP% with a decoy filename (.cache<rnd> on POSIX, dotnetdiag<rnd>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh or cmd. A marker file recording process.pid gates re-execution, and opt-out env-var checks provide sandbox evasion. The behavior has no relation to the package's stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:08:21Z",
            "sha256": "844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909",
            "id": "IN-MAL-2026-015180",
            "versions": [
                "35.5.1"
            ],
            "import_time": "2026-08-05T14:20:10.204382477Z"
        }
    ]
}
References
Credits

Affected packages

npm / checkout-storybook-default

Package

Name
checkout-storybook-default
View open source insights on deps.dev
Purl
pkg:npm/checkout-storybook-default

Affected ranges

Affected versions

35.*
35.5.1

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-4srEQsEe9kiOLBEcZX2nVwZias3uVNx8xP0bynpsSwlFSAoUETauH74XSMm92TYHxsfGpblSI4QEIhJ4Ztocfg==",
                "sha1": "33cd4411594b41632c7e619e229bc213de321c00"
            },
            "filename": "checkout-storybook-default-35.5.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "sha256": "9de803b1e239bb7b38d15ee98ce86267fedfad10821bbffa2af82b2c1581e2d4",
            "tlsh": "5fa1869616a670184bb0dbe4871b5415f65bf6a333c082d4fb6ca5981fb71244372efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-storybook-default/MAL-2026-12593.json"