sme-rko-finance-front-operations-fee

{"modified":"2026-08-08T00:46:28Z","published":"2026-08-08T00:46:28Z","schema_version":"1.7.4","id":"MAL-2026-13635","summary":"Malicious code in sme-rko-finance-front-operations-fee (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5)\nThe package's main entry (`./lib/telemetry`) and its `_vendor.js` module execute a binary dropper at require/import time. Hostnames and API identifiers are reconstructed from split-string arrays to evade static search — for example `[\"oob-worker.cf103-070.worke\",\"rs.d\",\"ev\"].join(\"\")` and `require(\"child_\"+\"process\")` / `fs[\"chmod\"+\"Sync\"]`. The dropper selects a platform-specific executable, fetches it over `https.get` from anonymous Cloudflare `workers.dev` origins (`oob-worker.cf103-070.workers.dev`, `cf100-416.workers.dev`, `cf99-9b3.workers.dev`, `cf101-adf.workers.dev`), with a base64 DNS-TXT fallback channel over `*.dl.wel1.ru` (e.g. `sdk.dl.wel1.ru`). The fetched bytes are written to `/var/tmp/.cache_<hex>` on Linux or `%TEMP%\\dotnet_diag_<hex>.exe` on Windows, `chmod 0755` is applied, and the file is spawned detached via `/bin/sh -c \"<path> &\"` or `cmd /c start /b`. A parallel dropper path inside `lib/telemetry.js` performs the same fetch → base64-decode → chmod +x → detached spawn sequence. No pinning, no signature verification, and mutable anonymous hosts. Installing or requiring the package results in remote code execution on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-operations-fee"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"640cf3bd44f39d9482067b5c9d57a9c385354b4b938b0060a8604517674f12b9","tlsh":"e6a1b65a16fa30180792e1d4852f9816709bf6933285d984fb4c6694cfeb628c3f39fc"},{"path":"lib/telemetry.js","sha256":"e989798d1105dad02fdee813aa8be4da9a5bc00ae981d881c85300a5fbddb2f3","tlsh":"8773304966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"sme-rko-finance-front-operations-fee-35.8.1.tgz","hashes":{"sha1":"458f5df87348fb0fde6bf72c150fbb695672b86e","sha512_sri":"sha512-Pz+5NteOB4nlEgcd0XKD4pvSv4aajzV0LzkSc2hnbLwb1wsvGFZNQO8Ao7R9fz+qFtvI6Fim4p314nNiiKldzA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-operations-fee/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017160","import_time":"2026-08-08T00:53:07.728363502Z","modified_time":"2026-08-08T00:46:28Z","sha256":"6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5","source":"amazon-inspector","versions":["35.8.1"]}]}}