checkout-accounts-holder

{"modified":"2026-08-05T14:15:27Z","published":"2026-08-05T14:15:27Z","schema_version":"1.7.4","id":"MAL-2026-12541","summary":"Malicious code in checkout-accounts-holder (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a)\nOn `require('checkout-accounts-holder')`, index.js loads _platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames assembled at runtime via `.join(\"\")` over split string fragments (resolving to `oob-worker.cf100-416.workers.dev` with a DNS TXT fallback under `sdk.dl.wel1.ru`), writes the opaque payload to /tmp or %TEMP% under cover names such as `.cache_<rand>` and `dotnet_diag_<rand>.exe`, chmods it 0o755, and spawns it detached via `/bin/sh -c \"<path> &\"` or `cmd.exe /c start`. The module presents itself as `analytics_state`/telemetry. A second dropper of the same shape ships in lib/telemetry.js (base64-chunked payload, `fs[\"chmod\"+\"Sync\"]`, `require(\"child_\"+\"process\")`, `spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"])`), currently unreferenced but present in the published tarball. Destination hostnames are string-split to evade plain-text scanners, and the run-write-chmod-spawn chain executes attacker-controlled bytes with the installer's privileges.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-accounts-holder"},"versions":["35.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"b114f027f7f805b7573c59246f3701ea56ba2dca4c3fe719e5554d17ba24bcf7","tlsh":"7da1a69a066570188bb097e5c7274416f55bf6633380c6d4f7aca5981fb712483b2efc"},{"path":"lib/telemetry.js","sha256":"df016932a45ed41d75147ab3382dbd1d4dcf8991e88950ce07b0a236e47bc648","tlsh":"28835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"checkout-accounts-holder-35.2.3.tgz","hashes":{"sha1":"c85f6f4c4de4495b197dd2771c33b382e5bdc5f7","sha512_sri":"sha512-7OpQVJMQ8kBkcOGzzvN3kVt4Dg+FuKDR8ZiolAM31/SoCiXThKTVGRKm7xJn3cMLysAATKiSwZKlOICCqUpkLg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-accounts-holder/v/35.2.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015228","import_time":"2026-08-05T14:20:14.814083459Z","modified_time":"2026-08-05T14:15:27Z","sha256":"cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a","source":"amazon-inspector","versions":["35.2.3"]}]}}