🛡️ MAL-2026-12585 — checkout-pay-widget-logic

Malicious code in checkout-pay-widget-logic (npm)

Source: amazon-inspector

On require('checkout-pay-widget-logic'), index.js loads./_vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf*.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru that reassembles base64 chunks from TXT records. C2 hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched binary is written to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows, mimicking a Microsoft diagnostic tool), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored. A lock file named.analytics_state and 'telemetry'-labeled functions provide a cover story; the package's stated purpose is a 'log formatter'. Environment-variable opt-outs exist but the dropper runs by default.