checkout-cashback-logic

{"modified":"2026-08-05T14:15:48Z","published":"2026-08-05T14:15:48Z","schema_version":"1.7.4","id":"MAL-2026-12546","summary":"Malicious code in checkout-cashback-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3)\ncheckout-cashback-logic@35.4.3 silently requires _bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) from split string arrays, with a DNS TXT chunked fallback channel using *.dl.wel1.ru subdomains reconstructed the same way. It downloads a platform-specific native executable, writes it to /tmp under hidden or misleading names (a dotfile such as.cache_<hex>/.analytics_state on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. There is no integrity check on the fetched binary, the destinations are unrelated to the package's stated logging/cashback purpose, and the string-splitting reconstruction of the hosts is deliberate evasion of static analysis. Any require() of this package results in an opaque attacker-controlled binary running on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-cashback-logic"},"versions":["35.4.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"5a7946084b97c9ab756beb94f79b0bc6c6fd53e47b930c8eabf6a0e14fc9bc21","tlsh":"a5b198aa156a70184b70d7e4c6175415f566f2637380c294f79ca9d81ff722482b2efc"}],"package_integrity":[{"filename":"checkout-cashback-logic-35.4.3.tgz","hashes":{"sha1":"7bc2edccbf5ac2398b361f626846cf6d6ed25dc2","sha512_sri":"sha512-8q6ftGi/dFB1qRnRnEpCZNM1NsuKRoBJJQpvIQ5qMJS2DtbqULw45tiaFRpb5BnJCuo+bTAc2TlVlLhno+jsPQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-cashback-logic/v/35.4.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015230","import_time":"2026-08-05T14:20:14.969856455Z","modified_time":"2026-08-05T14:15:48Z","sha256":"493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3","source":"amazon-inspector","versions":["35.4.3"]}]}}