MalwarePublished 5 Aug 2026

checkout-desktop-promocode (npm) · Malicious Code

Affects checkout-desktop-promocodeSource GCVE Database

Malicious package : remove checkout-desktop-promocode and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12560

What to do

Remove checkout-desktop-promocode from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcheckout-desktop-promocode	Affected =35.4.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'checkout-desktop-promocode' version 35.4.3 contains malicious code that, when imported, downloads and executes attacker-controlled binaries on the host system. It masquerades as a promocode SDK but performs no legitimate functionality. Instead, it fetches binaries from obfuscated, author-controlled domains using covert DNS-TXT fallback channels, writes them to temporary directories with innocuous filenames, sets executable permissions, and runs them detached via shell commands. This results in arbitrary code execution on the installer's machine.

Impact

Importing this package leads to arbitrary code execution on the host system, allowing attackers to run any code with the privileges of the user installing the package. This can result in full system compromise, data theft, persistence, or further malware deployment. The malicious behavior is triggered simply by requiring the package, without any additional user interaction.

Defensive guidance

Users should avoid installing or importing the 'checkout-desktop-promocode' package version 35.4.3. Remove any installations of this package from systems and audit for potential compromise. Monitor for suspicious network connections to the listed malicious domains. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.

Summary

The 'checkout-desktop-promocode' npm package (version 35.4.3) is a malicious package that, upon require(), loads a script that selects a platform-specific endpoint and downloads a binary over HTTPS from obfuscated, attacker-controlled hosts. It uses runtime assembly of command-and-control hostnames to evade static detection and employs a DNS-TXT chunked base64 covert channel as a fallback. The downloaded binary is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The package does not provide any promocode functionality and solely serves to execute arbitrary attacker code on the host system.

References

npmjs.com/package/checkout-desktop-promocode/v/35.4.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:56 UTC

Technical details

References

Community reviews