🛡️ MAL-2026-12549 — checkout-confirm-pos-order-sms-am

Malicious code in checkout-confirm-pos-order-sms-am (npm)

Source: amazon-inspector

On require() of this package, index.js loads _init.js which invokes init() immediately. init() downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime via split-join of small string fragments to evade static scanners. A DNS-TXT fallback reassembles the payload from base64 chunks served under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix or dotnet_diag_<hex>.exe on Windows mimicking a.NET diagnostic tool), chmod 0755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe; the spawn is unref()'d so it outlives the Node process. Execution is throttled by a /tmp cooldown file. The tarball also ships lib/telemetry.js (~81 KB, framed with 'Analytics SDK' comments) containing an equivalent dropper: split require('child_'+'process'), base64 chunk assembly, fs['chmod'+'Sync'](path, 0o755), and cp.spawn('/bin/sh', ['-c', filePath+' &']). The require('child_process'), fs.chmodSync, and spawn identifiers are string-split throughout to hide from keyword scanners. Package name lookalike of a checkout/POS SMS confirmation utility. Installing or requiring this package executes attacker-controlled native code on the installer's machine.