checkout-mobile-input-card @35.7.7
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12575
Ecosystem
npm
Summary
On require() of the package, index.js loads _shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (hostnames reconstructed via array-join splits such as ["oob-worker.cf103-070.wor","kers.","de","v"].join("")) with a DNS TXT covert-channel fallback that reassembles a base64-encoded binary from numbered TXT records under *.dl.wel1.ru. The downloaded payload is written to /var/tmp/.cache_XXXX on Unix or %TEMP%\dotnet_diag_XXXX.exe on Windows (masquerading as cache/diagnostic files), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Additional string-splitting obfuscates identifiers such as require("child_" + "process") and fs["chmod" + "Sync"]. The package name mimics a legitimate checkout/payments component.
Source: amazon-inspector (b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.