checkout-post-installment-client-agreement-accept-am @35.2.3
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12586
Ecosystem
npm
Summary
On require(), index.js loads _support.js which assembles Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) via array-join concealment and fetches a platform-specific binary over HTTPS, with a DNS-TXT base64-chunk fallback channel served from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru. The retrieved bytes are written to a temp path with a disguised name (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmod 0755'd, and detached-spawned via /bin/sh -c or cmd /c start, so the payload runs at import time with the installer's privileges. A second dropper implementation with the same fetch/write/chmod 755/spawn primitives is bundled in lib/telemetry.js under an 'Analytics SDK' cover story, using concatenated API names (chmod+Sync, child_+process) and base64 buffer decoding. Package name and 'telemetry/analytics' framing are cover-story labels; the actual behavior is remote code delivery and execution on the installer's host from author-controlled infrastructure.
Source: amazon-inspector (3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.