checkout-test-component

{"modified":"2026-08-05T14:08:28Z","published":"2026-08-05T14:08:28Z","schema_version":"1.7.4","id":"MAL-2026-12595","summary":"Malicious code in checkout-test-component (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0)\nOn require() of the package, index.js loads./_runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS/TXT fallback to *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under cover-story names (.cache_<hex>, dotnet_diag_<hex>.exe, analytics_state), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are constructed by fragment-and-.join(\"\") to evade static analysis. A secondary dropper implementation is shipped as lib/telemetry.js (~81 KB) using base64 chunk decoding, cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"]), and fs[\"chmod\"+\"Sync\"] with 0755, framed as an analytics.node SDK — duplicating the dropper mechanism as a dormant secondary payload. The package name resembles a benign test/checkout utility but contains no such functionality; its sole effect on load is to drop and execute attacker-controlled code on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-test-component"},"versions":["35.9.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"3d60c6dc5b4b45ea8d6f54ab5fa1e8c00b0bbcb5a5fe8cbc2457976385ab2ec6","tlsh":"f7b1859a01a671188bb0dbe4871b8816f65bf6633280c6c4f79c69945f77124c2b2efc"},{"path":"lib/telemetry.js","sha256":"c14e2228752a21af81ab3e84f5c1e55acc9932e7276baa7a2fddc9787b75b014","tlsh":"e4835056566a142186b2b368df234107ff3685272642429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"checkout-test-component-35.9.8.tgz","hashes":{"sha1":"f69fbcf806d0695c3c3d9571e4ddba7c85b73ab0","sha512_sri":"sha512-MbHcAGcqau5bpRL14PWOKF0MWTak4vkvixuF2wX0ZeMqtJYoHnAzPPXgnlcJGEGG0mc67qk5etNBj0Gvex6NvQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-test-component/v/35.9.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015181","import_time":"2026-08-05T14:20:10.290587113Z","modified_time":"2026-08-05T14:08:28Z","sha256":"c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0","source":"amazon-inspector","versions":["35.9.8"]}]}}