MAL-2026-12583 Malicious code in checkout-parameters (npm)

On require('checkout-parameters'), index.js loads _vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on the installer's machine. Destination hostnames are reconstructed at runtime via string-split concatenation (e.g. array .join("") producing subdomains under .workers.dev, with a .dl.wel1.ru fallback) to hide them from static inspection. The fetched payload is written to a disguised hidden path (/var/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), chmod'd to 0755, and launched detached via /bin/sh -c or cmd /c start /b. A sibling module lib/telemetry.js ships the same fetch → base64-decode → write → chmod 0755 → spawn("/bin/sh",["-c", path+" &"]) pattern under an 'analytics SDK' cover story, and uses concatenated identifiers (require("child_"+"process"), fs["chmod"+"Sync"]) as further evasion. Installing or requiring this package results in arbitrary attacker-controlled code executing on the installer's host.