checkout-create-draft-agreement-am

{"modified":"2026-08-05T14:15:56Z","published":"2026-08-05T14:15:56Z","schema_version":"1.7.4","id":"MAL-2026-12551","summary":"Malicious code in checkout-create-draft-agreement-am (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977)\nOn require of checkout-create-draft-agreement-am, index.js loads _polyfill.js which downloads a platform-specific native binary from Cloudflare Workers hosts whose names are assembled by joining split character arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT covert fallback channel on *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) that retrieves base64-chunked payloads via c.<domain> and i.<domain> TXT queries. The fetched bytes are written to /var/tmp/.cache_<uid> (or Temp\\dotnet_diag_<uid>.exe on Windows), chmod 0755, and spawned detached via child_process.spawn(\"/bin/sh\" or \"cmd\"). No hash or signature verification is performed, hosts are unrelated to the package's declared 'checkout draft agreement' purpose, and the TTL marker is disguised as 'analytics_state' with a self-labeled telemetry opt-out as cover.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-create-draft-agreement-am"},"versions":["35.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"45f9b40c9ce92c6ceb8ea5d302ed8a277fba505d83a9b5aa8b770a749f8807d8","tlsh":"c0b1655a0666b0084af0e7e487178825f65ff6533781c284fb9c69945f7352483b2efc"}],"package_integrity":[{"filename":"checkout-create-draft-agreement-am-35.1.1.tgz","hashes":{"sha1":"2a91a820f541fba77f57469e54f4ac46f6e2e701","sha512_sri":"sha512-Ot4qsmXOvVCkFjN6SVYTx6bnXUbVcyvXbUXJaMrl6aMQ7YGEITH8hPe7Fsj1RTfm1gCn0f2t2Ri9YWT2QUYUJQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-create-draft-agreement-am/v/35.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015231","import_time":"2026-08-05T14:20:15.046589511Z","modified_time":"2026-08-05T14:15:56Z","sha256":"10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977","source":"amazon-inspector","versions":["35.1.1"]}]}}