checkout-use-notifications @35.6.1
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12602
Ecosystem
npm
Summary
On require of the package, index.js unconditionally loads _shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT-record fallback channel via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are assembled at runtime by joining split string fragments to evade static detection. The fetched payload is written to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd with stdio ignored. The DNS fallback base64-decodes numbered TXT chunks to reconstruct the payload when HTTPS fetches fail. An anti-re-run stamp gates repeated execution. The delivery infrastructure, string-split hostname obfuscation, disguised on-disk filenames, and DNS covert channel are canonical malicious dropper fingerprints.
Source: amazon-inspector (1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.