Malicious code in checkout-desktop-total (npm)

The npm package checkout-desktop-total was found to contain malicious code that executes automatically when the package is imported. Upon require of index.js, a _platform.js module runs a setup() routine that unconditionally downloads a platform-specific binary payload from attacker-controlled infrastructure.

The malware uses multiple delivery channels: primary hosts on Cloudflare Workers (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback mechanism under *.dl.wel1.ru. The DNS fallback reconstructs the payload by querying for chunk count and base64-encoded chunks that are concatenated and decoded. Host literals are obfuscated by splitting into arrays and joining at runtime to evade detection.

The downloaded payload is written to disguised temporary file paths—'.cache_' under /tmp on Unix systems or 'dotnet_diag_.exe' under %TEMP% on Windows—with executable permissions (0755), then spawned detached via shell commands (/bin/sh -c on Unix, cmd.exe /c start /b on Windows). An on-disk marker '.analytics_state' is written to track execution. The package name and filenames impersonate legitimate tooling to avoid suspicion.

Systems that imported this package should be considered compromised. Remediation requires rotating all accessible secrets, investigating temporary-file execution patterns, and monitoring DNS activity to the listed infrastructure.