checkout-parameters

{"modified":"2026-08-05T14:09:04Z","published":"2026-08-05T14:09:04Z","schema_version":"1.7.4","id":"MAL-2026-12583","summary":"Malicious code in checkout-parameters (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc0cff223506622cf77c0c0c038390701fbc4dfa3bb8a1be146263a9eede7774)\nOn require('checkout-parameters'), index.js loads _vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on the installer's machine. Destination hostnames are reconstructed at runtime via string-split concatenation (e.g. array `.join(\"\")` producing subdomains under `.workers.dev`, with a `.dl.wel1.ru` fallback) to hide them from static inspection. The fetched payload is written to a disguised hidden path (`/var/tmp/.cache_<hex>` on Unix, `%TEMP%\\dotnet_diag_<hex>.exe` on Windows), chmod'd to 0755, and launched detached via `/bin/sh -c` or `cmd /c start /b`. A sibling module lib/telemetry.js ships the same fetch → base64-decode → write → chmod 0755 → spawn(\"/bin/sh\",[\"-c\", path+\" &\"]) pattern under an 'analytics SDK' cover story, and uses concatenated identifiers (`require(\"child_\"+\"process\")`, `fs[\"chmod\"+\"Sync\"]`) as further evasion. Installing or requiring this package results in arbitrary attacker-controlled code executing on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-parameters"},"versions":["35.8.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"bbae7c803f729966b4fa277f2821aef75ed6b89c999eb670ea7f0d6f54d816b4","tlsh":"ffa1979602a6b01c4fb0a7e4c61b8816f65bf663378181c4fb9c65985fb251483b2efc"},{"path":"lib/telemetry.js","sha256":"418fd081150d4a4428552c48c11788f2624b11338ef5343e3b5dc62a55d42351","tlsh":"b1835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"checkout-parameters-35.8.5.tgz","hashes":{"sha1":"8f6011576c0348265c22867c103853400073ac9d","sha512_sri":"sha512-5KzSGht2wjrxx9gZYcXyFO/+RFBWnRmKd0bBFT+3I9p7k8141c0B1ySuF5NnU6IBNdgjeasiV6XU9SpR5AOONA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-parameters/v/35.8.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015185","import_time":"2026-08-05T14:20:10.687698322Z","modified_time":"2026-08-05T14:09:04Z","sha256":"cc0cff223506622cf77c0c0c038390701fbc4dfa3bb8a1be146263a9eede7774","source":"amazon-inspector","versions":["35.8.5"]}]}}