checkout-storage-service

{"modified":"2026-08-05T14:09:12Z","published":"2026-08-05T14:09:12Z","schema_version":"1.7.4","id":"MAL-2026-12592","summary":"Malicious code in checkout-storage-service (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1)\nOn require of checkout-storage-service, _helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched payload is written to /tmp/.cache_<hex> on Unix or TEMP\\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Host strings are assembled from split arrays via.join('') to evade static analysis, execution is throttled by a TTL flag file and DO_NOT_TRACK-style env checks styled as opt-out telemetry, and stderr logging is silenced by a no-op sink. The destination hosts are anonymous Cloudflare Workers unrelated to the package publisher, the payload is opaque, and the staged filenames (hidden dotfile in /tmp, dotnet_diag masquerade on Windows) are intended to blend into normal system paths.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-storage-service"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"391d4e7ca2db74ff6e6497dedd3cd4d754d23bb8633cea8c6724c455d31c0097","tlsh":"f7b1a65615a670188bb0e7f1c7075415f657f66333808294fb9ca5981ff312882b2efc"}],"package_integrity":[{"filename":"checkout-storage-service-35.2.9.tgz","hashes":{"sha1":"652ab90b505f99e30c42b1b62ba323e5e07459df","sha512_sri":"sha512-iCZGy8mmBlILIukS/Resb2Dt9zA5fWMvFwpcKYi2ZtimnOykFhWlOxVmn3yy5XJ2rMSOAVMnAC4YGbgwU4TyFQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-storage-service/v/35.2.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015186","import_time":"2026-08-05T14:20:10.779407838Z","modified_time":"2026-08-05T14:09:12Z","sha256":"9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1","source":"amazon-inspector","versions":["35.2.9"]}]}}