checkout-storage-service @35.2.9
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12592
Ecosystem
npm
Summary
On require of checkout-storage-service, _helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched payload is written to /tmp/.cache_<hex> on Unix or TEMP\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Host strings are assembled from split arrays via.join('') to evade static analysis, execution is throttled by a TTL flag file and DO_NOT_TRACK-style env checks styled as opt-out telemetry, and stderr logging is silenced by a no-op sink. The destination hosts are anonymous Cloudflare Workers unrelated to the package publisher, the payload is opaque, and the staged filenames (hidden dotfile in /tmp, dotnet_diag masquerade on Windows) are intended to blend into normal system paths.
Source: amazon-inspector (9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.