🛡️ MAL-2026-12561 — checkout-desktop-total

Malicious code in checkout-desktop-total (npm)

Source: amazon-inspector

On require of index.js, _platform.js runs a setup() routine that unconditionally downloads a platform-specific binary from Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback channel under *.dl.wel1.ru (c.<domain> returns a chunk count, N.<domain> returns base64 chunks that are concatenated and decoded). Host literals are split into arrays and joined at runtime to evade grep-based scanning. The downloaded bytes are written to a disguised path — '.cache_<rand>' under /tmp on Unix, 'dotnet_diag_<rand>.exe' under %TEMP% on Windows — chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b with windowsHide:true. An on-disk marker '.analytics_state' is written. The package name and its deceptive filenames impersonate benign tooling; there is no legitimate reason for a 'checkout-desktop-total' library entry to fetch and execute an opaque binary from a Cloudflare Workers host on import.