checkout-pay-widget-logic

{"modified":"2026-08-05T14:09:46Z","published":"2026-08-05T14:09:46Z","schema_version":"1.7.4","id":"MAL-2026-12585","summary":"Malicious code in checkout-pay-widget-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f)\nOn require('checkout-pay-widget-logic'), index.js loads./_vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf*.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru that reassembles base64 chunks from TXT records. C2 hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched binary is written to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows, mimicking a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A lock file named.analytics_state and 'telemetry'-labeled functions provide a cover story; the package's stated purpose is a 'log formatter'. Environment-variable opt-outs exist but the dropper runs by default.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-pay-widget-logic"},"versions":["35.3.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"c0b79fa22ec08ba2eb3049697964d89fa752e6bc4c08e0b88226e941bf2dada4","tlsh":"89a1859a217671094bb0d7e0cb175416f66bf6a33380c598fa5ca5944f7612883b1efc"}],"package_integrity":[{"filename":"checkout-pay-widget-logic-35.3.2.tgz","hashes":{"sha1":"7f1c334e873fabe4fea1a537febef6e18747765b","sha512_sri":"sha512-VlHYX48pS438qK1rx/aBmz2o7/MpIGj8dizYjPRQVXXM7X8o0fX3lkBS7V65PYmf9X3f5GJhtANCdMn3it6mmw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-pay-widget-logic/v/35.3.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015190","import_time":"2026-08-05T14:20:11.33773427Z","modified_time":"2026-08-05T14:09:46Z","sha256":"3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f","source":"amazon-inspector","versions":["35.3.2"]}]}}