🛡️ MAL-2026-12553 — checkout-desktop-accounts

Malicious code in checkout-desktop-accounts (npm)

Source: amazon-inspector

The package's main entry unconditionally requires./_loader on load. _loader.js reconstructs C2 hostnames from string fragments (oob-worker.cf*.workers.dev) and, on failure, reassembles a base64 payload from DNS TXT records under c.<domain> and N.<domain> on dl.wel1.ru. It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe (a name mimicking a Microsoft diagnostics tool), chmods 755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A hidden stamp file (.analytics_state) is written to gate re-execution, and DO_NOT_TRACK/DISABLE_TELEMETRY env vars are honored to present a cooperative telemetry facade over the covert native payload. The runtime-assembled hostnames, DNS-TXT covert channel, disguised filename, TMP-staging, chmod+x, and detached spawn together form an unambiguous remote-code-execution dropper triggered on any require of the package.