OpenSSF/OSV advisory MAL-2026-12063 confirms this npm version as malicious. On require of the package's main entry, _support.js selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads a native binary from runtime-assembled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT covert-channel fallback (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in checkout-create-pos-order-am (npm)
Details
On require of the package's main entry, _support.js selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads a native binary from runtime-assembled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT covert-channel fallback (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), writes it to /tmp or the Windows temp directory under disguised names (e.g. dotnet_diag_*,.cache_*), chmods it 0o755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are assembled via split/join string concatenation to evade static scanners, and DNS TXT records deliver a chunked base64 payload as a secondary channel. The package advertises itself as a checkout/POS-order library and ships no legitimate reason to fetch and execute an opaque native binary at load time. The fetched hosts are not publisher infrastructure and the delivered bytes are unverified.
Decision reason
OpenSSF Malicious Packages via OSV confirms checkout-create-pos-order-am@20.9.5 as malicious (MAL-2026-12063): Malicious code in checkout-create-pos-order-am (npm)