checkout-desktop-accounts

{"modified":"2026-08-05T14:15:00Z","published":"2026-08-05T14:15:00Z","schema_version":"1.7.4","id":"MAL-2026-12553","summary":"Malicious code in checkout-desktop-accounts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b)\nThe package's main entry unconditionally requires./_loader on load. _loader.js reconstructs C2 hostnames from string fragments (oob-worker.cf*.workers.dev) and, on failure, reassembles a base64 payload from DNS TXT records under c.<domain> and N.<domain> on dl.wel1.ru. It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe (a name mimicking a Microsoft diagnostics tool), chmods 755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A hidden stamp file (.analytics_state) is written to gate re-execution, and DO_NOT_TRACK/DISABLE_TELEMETRY env vars are honored to present a cooperative telemetry facade over the covert native payload. The runtime-assembled hostnames, DNS-TXT covert channel, disguised filename, TMP-staging, chmod+x, and detached spawn together form an unambiguous remote-code-execution dropper triggered on any require of the package.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-desktop-accounts"},"versions":["35.7.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"a485d7c1ac0ca4c2701020e3ca3ef27274c89ce4befaeba1d83093465690f00f","tlsh":"1ab1ba9616a570188bb0dbe48b275816f66bf573338092c4fb5ca5941f7612483b3dfc"}],"package_integrity":[{"filename":"checkout-desktop-accounts-35.7.4.tgz","hashes":{"sha1":"e68a60aab0ff3e7c762a41606650aef3b5deb5da","sha512_sri":"sha512-Z5LJPbYOW73DGiFZW6G9rj38vhsR7wwnCRXPG50N3P7j+Ef/jRPe+YX9H6zejR8DbTqBv/v/hMP92MvIBtmpQg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-desktop-accounts/v/35.7.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015225","import_time":"2026-08-05T14:20:14.482234413Z","modified_time":"2026-08-05T14:15:00Z","sha256":"2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b","source":"amazon-inspector","versions":["35.7.4"]}]}}