Malicious code in checkout-storage-service (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1) On require of checkout-storage-service, _helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched payload is written to /tmp/.cache_<hex> on Unix or TEMP\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Host strings are assembled from split arrays via.join('') to evade static analysis, execution is throttled by a TTL flag file and DO_NOT_TRACK-style env checks styled as opt-out telemetry, and stderr logging is silenced by a no-op sink. The destination hosts are anonymous Cloudflare Workers unrelated to the package publisher, the payload is opaque, and the staged filenames (hidden dotfile in /tmp, dotnet_diag masquerade on Windows) are intended to blend into normal system paths.
Malicious code in checkout-storage-service (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1) On require of checkout-storage-service, _helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched payload is written to /tmp/.cache_<hex> on Unix or TEMP\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Host strings are assembled from split arrays via.join('') to evade static analysis, execution is throttled by a TTL flag file and DO_NOT_TRACK-style env checks styled as opt-out telemetry, and stderr logging is silenced by a no-op sink. The destination hosts are anonymous Cloudflare Workers unrelated to the package publisher, the payload is opaque, and the staged filenames (hidden dotfile in /tmp, dotnet_diag masquerade on Windows) are intended to blend into normal system paths.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12592
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735733bf8831d53913d0ea
Added to database: 08/05/2026, 15:30:59 UTC
Last updated: 08/05/2026, 15:39:18 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.