🛡️ MAL-2026-12590 — checkout-resend-pos-order-sms-am

Malicious code in checkout-resend-pos-order-sms-am (npm)

Source: amazon-inspector

On require() of this package, index.js loads _polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation (e.g. 'oob-worker.cf10x-*.workers.dev' variants) and issues an https.get to download a platform-specific executable. The bytes are written to /var/tmp/.cache_<rnd> on Unix or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmodded to 0755, and spawned detached via spawn('/bin/sh', ['-c', <path> + ' &']) or the Windows equivalent. A DNS-TXT base64-chunk fallback via *.dl.wel1.ru resolvers is used when direct HTTPS fetch fails. The child_process module reference and 'chmodSync' string are also concatenated at runtime ('child_'+'process', 'chmod'+'Sync') to defeat static string matching. A sibling module lib/telemetry.js contains the same fetch/chmod-0755/sh-c-spawn dropper pattern, indicating shared payload infrastructure. The package's stated purpose (an SMS/POS order helper) is unrelated to downloading and executing native binaries from Cloudflare Workers subdomains, and the disguised on-disk filenames (.cache_*, dotnet_diag_*.exe) further indicate concealment rather than legitimate runtime setup.