checkout-desktop-pay-button

{"modified":"2026-08-05T14:13:19Z","published":"2026-08-05T14:13:19Z","schema_version":"1.7.4","id":"MAL-2026-12558","summary":"Malicious code in checkout-desktop-pay-button (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (67636a6aeed1ed70d1bfd731fb8a845f67279b3afa82aa45b8e7a8ac9fe41cee)\nOn require() of this package, index.js loads _bootstrap.js which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains assembled via array-join concatenation (e.g. oob-worker.cf103-070.workers.dev), with a DNS-TXT-chunk fallback channel that reassembles a base64 payload from numbered TXT records under net.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<rand>.exe or.cache_<rand>, chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe. The behavior is unrelated to the package's stated pay-button SDK purpose, and both the destination hostnames and the DNS discovery domain are reconstructed from split string fragments to evade static inspection. The name resembles a legitimate checkout/pay-button SDK, but the shipped code is an import-time dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-desktop-pay-button"},"versions":["35.5.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"38b38ad3dacdd5df85dd1d2744fe278bb825955aa1db19f1da3f7b5199bd0756","tlsh":"d2a1b75a066670194bb0abe4c71b8826f55bf6633781c284fb5c65889f73524c3b2efc"}],"package_integrity":[{"filename":"checkout-desktop-pay-button-35.5.4.tgz","hashes":{"sha1":"974502f87c6340c1c3488fea869cf19a691433be","sha512_sri":"sha512-SIxu0UhzVCbmM8W2m5A0DzdE4W0yVQMcDXhWLLYuuxy2dMyvY9oQjUV+oAX2E71FIuP4etmLXr+UA1f/l/iUAw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-desktop-pay-button/v/35.5.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015214","import_time":"2026-08-05T14:20:13.492383581Z","modified_time":"2026-08-05T14:13:19Z","sha256":"67636a6aeed1ed70d1bfd731fb8a845f67279b3afa82aa45b8e7a8ac9fe41cee","source":"amazon-inspector","versions":["35.5.4"]}]}}