🛡️ MAL-2026-12546 — checkout-cashback-logic

Malicious code in checkout-cashback-logic (npm)

Source: amazon-inspector

[email protected] silently requires _bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) from split string arrays, with a DNS TXT chunked fallback channel using *.dl.wel1.ru subdomains reconstructed the same way. It downloads a platform-specific native executable, writes it to /tmp under hidden or misleading names (a dotfile such as.cache_<hex>/.analytics_state on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. There is no integrity check on the fetched binary, the destinations are unrelated to the package's stated logging/cashback purpose, and the string-splitting reconstruction of the hosts is deliberate evasion of static analysis. Any require() of this package results in an opaque attacker-controlled binary running on the installer's host.