MAL-2026-12594

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-subscription-holder/MAL-2026-12594.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12594
Published
2026-08-05T14:09:19Z
Modified
2026-08-05T14:35:40.424209849Z
Summary
Malicious code in checkout-subscription-holder (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c)

On require() of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join("") string-splitting (assembling oob-worker.cf{101-adf,99-9b3,103-070,102-baf}.workers.dev and a *.dl.wel1.ru DNS-TXT base64 fallback resolver), downloads a platform-specific opaque binary, writes it to /var/tmp/.cache<hex> on POSIX or TEMP\dotnetdiag<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Filenames are chosen to masquerade as a dotnet diagnostic tool or generic cache, and a /tmp/.analyticsstate marker gates re-execution. The advertised package purpose ("subscription holder") has no connection to the fetched-and-executed binary, and the destination hosts are string-split constants rather than a documented, publisher-owned domain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c",
            "id": "IN-MAL-2026-015187",
            "modified_time": "2026-08-05T14:09:19Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T14:20:10.906987778Z",
            "versions": [
                "35.7.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-subscription-holder

Package

Name
checkout-subscription-holder
View open source insights on deps.dev
Purl
pkg:npm/checkout-subscription-holder

Affected ranges

Affected versions

35.*
35.7.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "5228d460ca6c6858162e7d68b89fc769cdc760cc2d0ad4e99d83c291be7151b4",
            "path": "_bootstrap.js",
            "tlsh": "33a1b566026570188bb0dbe5c7175416f62af663628085d4fb9c99880ff2124c3b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-dvK97dNplFIQoc98PaFKXFAXIpAm6BK2ytNc9UkJfYTer4BJfVSNVrxJjdGxN8zX2lYs4VjOa7SjRl9ueqFlng==",
                "sha1": "fb9110f68f9cd08bc45653ec967b050d264f8667"
            },
            "filename": "checkout-subscription-holder-35.7.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-subscription-holder/MAL-2026-12594.json"