checkout-base-test

{"modified":"2026-08-05T14:14:41Z","published":"2026-08-05T14:14:41Z","schema_version":"1.7.4","id":"MAL-2026-12544","summary":"Malicious code in checkout-base-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2)\nOn require() of this package, index.js loads _helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split string fragments joined at runtime (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), selects a platform-specific endpoint, fetches an opaque binary via https.get, writes it to /var/tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn(\"/bin/sh\", [\"-c\",...]) or spawn(\"cmd\",...). A DNS-TXT chunked base64 covert-channel fallback contacts *.dl.wel1.ru when the HTTPS hosts are unreachable. Additional evasion: require(\"child_\" + \"process\") string concatenation in lib/telemetry.js, environment-variable gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, and a filesystem session stamp to fire once per host. The disguised filenames (dotnet_diag_,.cache_) impersonate legitimate diagnostic artifacts. The package name resembles a checkout/test utility but ships no functionality matching that purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-base-test"},"versions":["35.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"915289c3afda2c1678b8690f5f6c7d694fb046fc270bf267a4bf46c6d630a6c8","tlsh":"9da1965a16ab7018cbb1dbf487075416f66be6633380c694fb9c69841f7212483b2efc"}],"package_integrity":[{"filename":"checkout-base-test-35.9.3.tgz","hashes":{"sha1":"6b1236ef01dc41a2a599d3692ed2c9e77c6813f2","sha512_sri":"sha512-EaSv7Im6lj58tAbrRwBOdi3PphPpze2N1L5X9qW/ZJnqNL+jYUrzPr2lytP8nQUaLEEcnlGl/rPNIqJhJkagiw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-base-test/v/35.9.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015223","import_time":"2026-08-05T14:20:14.318939313Z","modified_time":"2026-08-05T14:14:41Z","sha256":"3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2","source":"amazon-inspector","versions":["35.9.3"]}]}}