MalwarePublished 5 Aug 2026

checkout-mobile-cashback (npm) · Malicious Code

Affects checkout-mobile-cashbackSource GCVE Database

Malicious package : remove checkout-mobile-cashback and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12573

What to do

Remove checkout-mobile-cashback from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcheckout-mobile-cashback	Affected =35.4.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package checkout-mobile-cashback version 35.4.9 contains malicious code that executes a staged binary dropper upon module load. It fetches platform-specific binaries from hardcoded Cloudflare Workers URLs and fallback DNS-TXT base64 channels, writes them to temporary directories under disguised system-like filenames, sets executable permissions, and runs them detached without verification. The package disables telemetry logging to conceal this behavior. This malicious activity occurs as a side effect of importing the package.

Impact

The malicious code can execute arbitrary binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The use of obfuscated URL construction and fallback channels complicates detection. The disabling of telemetry logging reduces visibility into the malicious activity. Since the binaries are executed detached and without signature verification, this poses a significant risk of persistent and stealthy compromise.

Defensive guidance

Until a fix is available, avoid using checkout-mobile-cashback version 35.4.9. Remove the package from any environments where it is installed. Monitor for suspicious processes spawned from temporary directories with disguised system-like filenames. Consider using package integrity verification tools and restrict execution permissions in temporary directories to mitigate risk.

Summary

The checkout-mobile-cashback npm package at version 35.4.9 executes a staged binary dropper when imported. The index.js file requires a shim that selects a platform-specific binary URL from a hardcoded list of Cloudflare Workers hosts, constructed via array-join string splitting to evade static detection. It also uses a DNS-TXT chunked base64 fallback channel from unrelated domains. The fetched binary data is written to temporary directories (/tmp or %TEMP%) with filenames mimicking system tools, given executable permissions (chmod 0755), and executed detached via shell commands (/bin/sh -c or cmd.exe /c start /b). No hash or signature verification is performed on the binaries. The logging function is stubbed to a no-op, and an environment variable opt-out (DISABLE_TELEMETRY) provides a cover story for telemetry suppression. This behavior is unrelated to any declared publisher and occurs automatically on package import.

References

npmjs.com/package/checkout-mobile-cashback/v/35.4.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:58 UTC

Technical details

References

Community reviews