checkout-parametersnpm
Advisory published Updated
checkout-parameters is a confirmed malicious npm package (MAL-2026-12583) that executes malicious code on install (malicious version 35.8.5). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in checkout-parameters (npm)
What this malware does
On require('checkout-parameters'), index.js loads _vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on the installer's machine. Destination hostnames are reconstructed at runtime via string-split concatenation (e.g. array .join("") producing subdomains under .workers.dev, with a .dl.wel1.ru fallback) to hide them from static inspection. The fetched payload is written to a disguised hidden path (/var/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), chmod'd to 0755, and launched detached via /bin/sh -c or cmd /c start /b. A sibling module lib/telemetry.js ships the same fetch → base64-decode → write → chmod 0755 → spawn("/bin/sh",["-c", path+" &"]) pattern under an 'analytics SDK' cover story, and uses concatenated identifiers (require("child_"+"process"), fs["chmod"+"Sync"]) as further evasion. Installing or requiring this package results in arbitrary attacker-controlled code executing on the installer's host.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for checkout-parameters (version 35.8.5).
If you installed it — respond
Remove checkout-parameters from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If checkout-parameters was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks checkout-parameters-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.