checkout-input-card-logic

{"modified":"2026-08-05T14:11:53Z","published":"2026-08-05T14:11:53Z","schema_version":"1.7.4","id":"MAL-2026-12567","summary":"Malicious code in checkout-input-card-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb)\nOn require() of the package, index.js loads _vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains (oob-worker.cf*.workers.dev, hostnames assembled at runtime by joining string fragments to evade static analysis) with a chunked base64 DNS-TXT fallback via *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under cover names (`.cache_<rand>`, `dotnet_diag_<rand>.exe`, `analytics_state`), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe. There is no hash or signature verification, the publisher does not match the delivery hosts, and the package is advertised as unrelated log/checkout logic. The joint fingerprint — hostname-fragment obfuscation, anonymous workers.dev delivery, DNS-TXT fallback channel, cover-story filenames, detached native execution on import — is a supply-chain dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-input-card-logic"},"versions":["35.8.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"1cd9fa257d04f41950b8dcadff41d5b19e5d7ec33020a83bdd32af3bdcedd195","tlsh":"5ea1759a15a670098bb0ebf4c7175826f65be76333808588fb9c59884f7612483b1efc"}],"package_integrity":[{"filename":"checkout-input-card-logic-35.8.8.tgz","hashes":{"sha1":"2e77460cf82bd038a89202a4a8391045868a07c0","sha512_sri":"sha512-iK945wik0bSTzYhjGOok9EOe/Mx1dlVK3xKPCrtkrh6MX4YL26flXd++GmkZFuSbVcPnJFAnx+oBnJ55Fzq7HQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-input-card-logic/v/35.8.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015204","import_time":"2026-08-05T14:20:12.630609993Z","modified_time":"2026-08-05T14:11:53Z","sha256":"1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb","source":"amazon-inspector","versions":["35.8.8"]}]}}