Malicious code in checkout-create-pos-order-am (npm)
The npm package checkout-create-pos-order-am contains malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers hosts on require, with DNS-TXT covert-channel fallback. The package masquerades as a checkout/POS-order library but performs no legitimate function requiring binary execution.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of checkout-create-pos-order-am; arbitrary code execution on require across Linux (x64, ARM64), macOS, and Windows platforms.
- Ecosystems
- Attack vectors
- Affected entities
- checkout-create-pos-order-amnpm package containing malicious code in _support.js entry point
The npm package checkout-create-pos-order-am was found to contain malicious code in its main entry point (_support.js). Upon require, the code detects the platform (Linux x64, Linux ARM64, macOS, or Windows) and downloads a native binary from attacker-controlled infrastructure.
The binaries are fetched from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a secondary DNS-TXT covert channel using domains tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The downloaded binaries are written to temporary directories (/tmp on Unix, Windows temp on Windows) under disguised names (e.g., dotnet_diag_, .cache_), made executable (chmod 0o755), and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start /b).
The package advertises itself as a checkout/POS-order library with no legitimate reason to fetch and execute opaque native binaries at load time. The destination hostnames are assembled via string concatenation to evade static analysis, and DNS TXT records deliver chunked base64 payloads as a secondary delivery mechanism. The fetched binaries are unverified and sourced from non-publisher infrastructure.
This incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-cjcp-fwqf-qqr5."
Indicators of compromise
- Packages
- checkout-create-pos-order-am
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately remove checkout-create-pos-order-am from all projects and dependencies
- Audit npm install logs and lock files to identify all versions and installation dates of this package
- Assume any system that installed this package may be compromised; perform forensic analysis for signs of binary execution and network connections to the attacker infrastructure
- Block outbound connections to oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site at the network perimeter
- Review npm package dependencies for similar suspicious patterns (native binary downloads on require)
- Regenerate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-cjcp-fwqf-qqr5 · GitHub Advisory Database
Cite this entry
"Malicious code in checkout-create-pos-order-am (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-checkout-create-pos-order-am-npm-dfftvc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit