sme-rko-finance-front-operations-special-payments

{"modified":"2026-08-08T00:45:15Z","published":"2026-08-08T00:45:15Z","schema_version":"1.7.4","id":"MAL-2026-13648","summary":"Malicious code in sme-rko-finance-front-operations-special-payments (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242)\nOn require() of the package, index.js loads _support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS TXT chunked-transfer fallback to *.dl.wel1.ru. The payload is written to /tmp with a hidden name (.cache_<hex>) or to %TEMP% as dotnet_diag_<hex>.exe on Windows, chmodded 0755, and spawned detached via /bin/sh -c or cmd. The declared main module lib/telemetry.js contains a duplicate dropper path under an 'analytics SDK' cover story, base64-decoding transport chunks before executing the resulting binary the same way. C2 host names and dangerous API names (child_process, chmodSync) are constructed at runtime via array-join and string concatenation to defeat static analysis. Both dropper paths fire at library load time on any require of the package.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-operations-special-payments"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"013e10cd714cad9c62b44aee63e1741b2b300b96af5c211a47c34b58f1352f67","tlsh":"95a1a65916fa70180792e5d4841f5826709af69372c4e9c4fb4c66888fda138c3f3afc"},{"path":"lib/telemetry.js","sha256":"2b8e0f2982c4ab7fe4d6d1214a221fba4a5e2a367b8708d5c7fafc77df7d429c","tlsh":"2c733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"sme-rko-finance-front-operations-special-payments-35.8.1.tgz","hashes":{"sha1":"2aaa9932dc2960012c51ef7da3b9ff4e2d2eadef","sha512_sri":"sha512-QJh8VZqRC8JONmGpiMpJLpt05e6d6yt+uzBHQm1BLiDn66A98DV2WaVJZXXBzd1qu8imWm+nSk3KbMECUxubQw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-operations-special-payments/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017151","import_time":"2026-08-08T00:53:07.133581966Z","modified_time":"2026-08-08T00:45:15Z","sha256":"3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242","source":"amazon-inspector","versions":["35.8.1"]}]}}