checkout-mobile-dolyame

{"modified":"2026-08-05T14:11:35Z","published":"2026-08-05T14:11:35Z","schema_version":"1.7.4","id":"MAL-2026-12574","summary":"Malicious code in checkout-mobile-dolyame (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd)\nRequiring checkout-mobile-dolyame loads _loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated Cloudflare workers.dev mirrors (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime from split-string fragments joined with.join(''). A fallback delivery channel resolves DNS TXT records under c.<domain> and N.<domain> (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) to reassemble a base64-encoded payload, evading URL/domain filtering. The downloaded bytes are written to /var/tmp or %TEMP% under masqueraded names (.cache_<hex> or dotnet_diag_<hex>.exe), chmod 0755, then spawned detached via /bin/sh -c '<file> &' or cmd.exe /c start /b with stdio ignored. No hash or signature verification is performed. The name resembles legitimate Dolyame checkout tooling, but the package's only observable behavior on import is downloading and running arbitrary attacker-supplied code.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-mobile-dolyame"},"versions":["35.7.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"f9fb036bf83b9d49d16bc0db030c26a3f533e67da15efdc7abafe9959481d180","tlsh":"14b1979a16aa70184bb09be4c6174416f65af7633781c588f79c69981fb312482b2efc"}],"package_integrity":[{"filename":"checkout-mobile-dolyame-35.7.4.tgz","hashes":{"sha1":"5f83a835d7ef94726041e7748e86b761ee0ef5b0","sha512_sri":"sha512-iksIQt9Z+UzS2zqDODKr8HC9SIEFyCiTh6CXzfXZTrt66aUg4cXntcRJxyS83BYhzuGmgdMKjhbI4TynuSWsUw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-mobile-dolyame/v/35.7.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015202","import_time":"2026-08-05T14:20:12.451722408Z","modified_time":"2026-08-05T14:11:35Z","sha256":"5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd","source":"amazon-inspector","versions":["35.7.4"]}]}}