Malicious code in checkout-create-pos-order-am (npm)
The npm package checkout-create-pos-order-am contains malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers hosts on require, with DNS-TXT covert-channel fallback. The package masquerades as a checkout/POS-order library but performs no legitimate function requiring binary execution.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of checkout-create-pos-order-am; arbitrary code execution on require across Linux (x64, ARM64), macOS, and Windows platforms.
- Ecosystems
- Attack vectors
- Affected entities
- checkout-create-pos-order-amnpm package containing malicious code in _support.js entry point
The npm package checkout-create-pos-order-am was found to contain malicious code in its main entry point (_support.js). Upon require, the code detects the platform (Linux x64, Linux ARM64, macOS, or Windows) and downloads a native binary from attacker-controlled infrastructure.
The binaries are fetched from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a secondary DNS-TXT covert channel using domains tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The downloaded binaries are written to temporary directories (/tmp on Unix, Windows temp on Windows) under disguised names (e.g., dotnet_diag_, .cache_), made executable (chmod 0o755), and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start /b).
The package advertises itself as a checkout/POS-order library with no legitimate reason to fetch and execute opaque native binaries at load time. The destination hostnames are assembled via string concatenation to evade static analysis, and DNS TXT records deliver chunked base64 payloads as a secondary delivery mechanism. The fetched binaries are unverified and sourced from non-publisher infrastructure.
This incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-cjcp-fwqf-qqr5."
Indicators of compromise
- Packages
- checkout-create-pos-order-am
- Domains
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately remove checkout-create-pos-order-am from all projects and dependencies
- Audit npm install logs and lock files to identify all versions and installation dates of this package
- Assume any system that installed this package may be compromised; perform forensic analysis for signs of binary execution and network connections to the attacker infrastructure
- Block outbound connections to oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site at the network perimeter
- Review npm package dependencies for similar suspicious patterns (native binary downloads on require)
- Regenerate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-cjcp-fwqf-qqr5 · GitHub Advisory Database
Cite this entry
"Malicious code in checkout-create-pos-order-am (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-checkout-create-pos-order-am-npm-dfftvc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - resolvedcritical
Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gpt-terminal-cli (npm)
gpt-terminal-cli, an npm package advertised as an AI chat CLI, contains malicious code that installs a persistent remote access implant with extensive capabilities including reverse shell, credential theft, keylogging, and antiforensics. The implant communicates with a hardcoded C2 server and supports dynamic C2 rotation via DNS dead-drop.
npmCompromised packageMalicious commit