checkout-checkout-test-block-aff

{"modified":"2026-08-05T14:14:12Z","published":"2026-08-05T14:14:12Z","schema_version":"1.7.4","id":"MAL-2026-12547","summary":"Malicious code in checkout-checkout-test-block-aff (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87)\nOn require of the main entry, index.js loads _loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT record fallback channel using sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The destination hosts are reassembled via array-join (e.g. ['oob-worker.cf','101-adf.worke','rs.dev'].join('')) to evade static string scanners. The downloaded payload is written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows to impersonate a Microsoft diagnostic tool), chmodded 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or cmd. No hash or signature verification is performed despite a cover-story comment claiming a SHA-256 integrity check; a dedup lockfile at /tmp/.analytics_state gates re-execution. lib/telemetry.js (81 KB, framed as an 'Analytics SDK') replicates the same fetch->base64-decode->write->chmod+x->spawn shell chain, importing child_process via string concatenation (require('child_'+'process')) to further hide the primitive. Installing or requiring this package yields arbitrary remote code execution on the installer's host from attacker-controlled infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-checkout-test-block-aff"},"versions":["35.9.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"9694c64cd0725b803f6bdb2f3399e351143bffaf6bd45ce93bcb3725fb6ba889","tlsh":"38b1859a12a560194bb0e7e0c70b8816f65bf6633680c5d4fb9ca5844f73524c3b2efc"},{"path":"lib/telemetry.js","sha256":"27652bf0d3fd878bce0ce2e3fff0b88f1d22e0a79acce84965108448ce97314a","tlsh":"d3835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"checkout-checkout-test-block-aff-35.9.6.tgz","hashes":{"sha1":"af68b2054a75fc5ee042ece679388fda4ca416f9","sha512_sri":"sha512-BzJB3b6J7tmCSGUYQfJGGZ8tmY+heyHF4zgNxmFytG5la6NM7HqZvR0obQLWlQETswf2mA3CIJpnOD4qxFH+Bw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-checkout-test-block-aff/v/35.9.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015220","import_time":"2026-08-05T14:20:14.051298028Z","modified_time":"2026-08-05T14:14:12Z","sha256":"ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87","source":"amazon-inspector","versions":["35.9.6"]}]}}