{"answers":{"affected":"1 open source package ship an affected version, including checkout-dolyame-logic.","exploited":"There is no known exploitation of MAL-2026-12562 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12562 is a malicious package in checkout-dolyame-logic, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12562 is a malicious package: checkout-dolyame-logic (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12562/ (Markdown: https://insights.sbomify.com/MAL-2026-12562/index.md)","id":"MAL-2026-12562","markdown":"https://insights.sbomify.com/MAL-2026-12562/index.md","name":"MAL-2026-12562","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require of the package, index.js loads./_runtime.js, which assembles mirror hostnames from split string arrays (e.g. 'oob-wor'+'ker.cf99-9'+'b3.work'+'er'+'s.dev', 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf103-070.workers.dev') and DNS-fallback domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) to evade static string matching. The runtime selects an OS-specific asset, downloads an opaque native binary from those hosts (with a DNS TXT-record fallback that reassembles a base64-chunked payload), writes it to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe with.unref(). A second, parallel dropper is shipped in lib/telemetry.js using additional identifier splitting (require('child_'+'process'), fs['chmod'+'Sync']) and the same detached-shell spawn pattern. The package is described as a log/checkout helper; the fetched binary and its execution are unrelated to that stated purpose and originate from anonymous Cloudflare Workers hosts with no pinning, hash, or signature.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in checkout-dolyame-logic (npm)","id":"MAL-2026-12562","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"checkout-dolyame-logic","purl":"pkg:npm/checkout-dolyame-logic","source":"MAL-2026-12562"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12562/"}