MAL-2026-12603

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-use-toasts/MAL-2026-12603.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12603
Published
2026-08-05T14:07:46Z
Modified
2026-08-05T14:35:44.718097795Z
Summary
Malicious code in checkout-use-toasts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e)

On require() of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare workers.dev hosts (oob-worker.cf100/cf101/cf102-*.workers.dev) with a DNS-TXT fallback that resolves TXT records at subdomains of dl.wel1.ru and concatenates base64-decoded chunks as the payload. The bytes are written to /var/tmp/.cache<hex> (or %TEMP%\dotnetdiag<hex>.exe on Windows) under disguised names, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. Destination hostnames are split into fragments and joined at runtime (['oob-worker.cf102-baf.wor','ke','rs','.d','ev'].join(''); ['sdk.d','l.','we','l1.','ru'].join('')) to evade static string matching. There is no signature or version pinning on the fetched payload. The package name and stated purpose (toast notifications for checkout flows) do not match downloading and executing a native binary, and the DNS-TXT covert channel is designed to bypass HTTP egress controls. Installing or importing this package results in attacker-controlled code execution on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e",
            "id": "IN-MAL-2026-015176",
            "modified_time": "2026-08-05T14:07:46Z",
            "import_time": "2026-08-05T14:20:09.772934188Z",
            "source": "amazon-inspector",
            "versions": [
                "35.3.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / checkout-use-toasts

Package

Name
checkout-use-toasts
View open source insights on deps.dev
Purl
pkg:npm/checkout-use-toasts

Affected ranges

Affected versions

35.*
35.3.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "65ccdd9824492cd2911a81af234c2cc2c7be770673d115d6b450164fed7cf0ae",
            "path": "_bridge.js",
            "tlsh": "b2b185591265b1188bb0ebe0c71b4815f55ef5633780c2d4f79c69986fb352482b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-/i7Zz/mQmXyUhOMirJDm/7ThDbTPIJDW2iPMSUg1Vef2dNEgCXxJ93rbymyBfDPlCme/zXcxOEbmEEpOgqLRrw==",
                "sha1": "2a90254403c9be87cc62b503da4b49739679151c"
            },
            "filename": "checkout-use-toasts-35.3.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-use-toasts/MAL-2026-12603.json"