MalwarePublished 5 Aug 2026Updated 18 Aug 2026

checkout-common-tokens (npm) · Malicious Code

Affects checkout-common-tokensSource GCVE Database

Malicious package : remove checkout-common-tokens and rotate any secrets on hosts that installed it.

Data as of 18 Aug 2026, 13:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12351

What to do

Remove checkout-common-tokens from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcheckout-common-tokens	Affected =20.1.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'checkout-common-tokens' version 20.1.6 contains malicious code that, upon import, downloads and executes a platform-specific binary payload from obfuscated Cloudflare Workers subdomains or, if that fails, via a covert DNS-TXT channel. The payload is executed with the installer's privileges and mimics legitimate diagnostic files. This results in full system compromise, potentially exposing all stored secrets and keys. Immediate removal and secret rotation are strongly advised.

Impact

Any system with this package installed or running is considered fully compromised. The attacker gains execution with the installer's privileges, allowing potential access to all secrets, keys, and sensitive data stored on the system. Removal of the package alone does not guarantee eradication of the malicious payload or any persistence mechanisms. Secret and key rotation from a trusted environment is mandatory.

Defensive guidance

Remove the 'checkout-common-tokens' package version 20.1.6 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on compromised systems using a different, trusted device. Because the malicious payload executes with installer privileges and may persist beyond package removal, consider full system reimaging or forensic analysis to ensure complete eradication. Monitor for any suspicious activity related to the package and its artifacts.

Summary

The 'checkout-common-tokens' npm package version 20.1.6 includes malicious code in its index.js that loads an auxiliary script (_ext.js). This script dynamically constructs obfuscated URLs to fetch a binary payload over HTTPS from rotating Cloudflare Workers subdomains. The payload is saved to temporary system directories with names resembling legitimate telemetry files, permissioned for execution, and then spawned detached via shell commands. If the HTTPS fetch fails, the code uses a fallback covert channel via DNS-TXT record queries to reconstruct and execute the payload. The payload is unrelated to the package's documented functionality and runs with the privileges of the user installing or importing the package. This behavior results in full compromise of the host system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Aug 2026, 13:48 UTC

Technical details

References

Community reviews