sme-rko-finance-front-operations-feed-models

{"modified":"2026-08-08T00:43:15Z","published":"2026-08-08T00:43:15Z","schema_version":"1.7.4","id":"MAL-2026-13637","summary":"Malicious code in sme-rko-finance-front-operations-feed-models (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc)\nindex.js unconditionally requires./_runtime on package load. _runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one of four string-split *.workers.dev hosts (e.g. oob-worker.cf103-070.workers.dev), with a DNS TXT chunked-base64 fallback to sdk.dl.wel1.ru, writes the payload to /tmp or %TEMP% under a decoy name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and detach-spawns it via /bin/sh -c or cmd.exe. Network destinations are assembled at runtime by joining fragmented string arrays to evade static analysis, filenames impersonate dotnet diagnostics, and execution is rate-limited via a stamp file in /tmp. The fetched bytes are attacker-controlled opaque native executables unrelated to the package's stated purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-operations-feed-models"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"0b170eaec8c7340e2ab4efe19b8ed76c94e2d998c3d74be48f3af5de566432c4","tlsh":"c2a1965516fa70280b92e1d4851f8816729bf9933684d5c4f78c26548fd763983b3dec"}],"package_integrity":[{"filename":"sme-rko-finance-front-operations-feed-models-35.8.1.tgz","hashes":{"sha1":"3f2143dab94253548a983c881fbeac7d57edd72f","sha512_sri":"sha512-geNo+FO43X7zY77GlYObF/t2IYgZyXQL7rBhgXTBIBe1VZN4akH7A913+AMwqjadfeRrRqg4W3zw8MkAdcxB8g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-operations-feed-models/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017138","import_time":"2026-08-08T00:53:06.140661616Z","modified_time":"2026-08-08T00:43:15Z","sha256":"13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc","source":"amazon-inspector","versions":["35.8.1"]}]}}