NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

checkout-get-pos-documents-amnpm

Advisory published Updated

checkout-get-pos-documents-am is a confirmed malicious npm package (MAL-2026-12565) that executes malicious code on install (malicious version 35.8.7). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in checkout-get-pos-documents-am (npm)

MAL-2026-12565
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall checkout-get-pos-documents-am

What this malware does

On any require/import of checkout-get-pos-documents-am, index.js loads _compat.js, which selects a per-platform binary (linux_x64, linux_arm64, darwin, win32.exe), downloads it over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled by joining string fragments (e.g. "oob-worker.c"+"f103-070.wor"+"kers.d"+"ev"), writes the bytes to /tmp or %TEMP% under a masqueraded name, chmods 0755, and detach-spawns it via cp.spawn("/bin/sh", ["-c", path+" &"], {detached:true}).unref(). If HTTPS fetch fails, the code falls back to a DNS-TXT covert channel, calling dns.resolveTxt against subdomains under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru and reassembling base64 chunks from TXT records into an executable payload. No hash or signature verification is performed and the fetched binary bears no relation to the package's stated "runtime support" purpose. A second dropper implementation with the same fetch → base64-decode → chmod 0755 → /bin/sh spawn shape is bundled as lib/telemetry.js under an "Analytics SDK" cover story. Hostname string-splitting, DNS-TXT payload transport, filename masquerade, and detached spawn are deliberate evasion techniques.

Malicious versions

1 flagged
35.8.7

Indicators of compromise (SHA-256)

0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for checkout-get-pos-documents-am (version 35.8.7).

  2. If you installed it — respond

    Remove checkout-get-pos-documents-am from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If checkout-get-pos-documents-am was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. checkout-get-pos-documents-am on npm has been identified as a malicious package (version 35.8.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015207

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks checkout-get-pos-documents-am-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
checkout-get-pos-documents-am (npm) malicious package — MAL-2026-12565 | O3 Security