sme-rko-finance-front-operations-widget-models

{"modified":"2026-08-08T00:46:04Z","published":"2026-08-08T00:46:04Z","schema_version":"1.7.4","id":"MAL-2026-13652","summary":"Malicious code in sme-rko-finance-front-operations-widget-models (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a)\nOn require of the package, `_platform.js` and `lib/telemetry.js` run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one of three anonymous Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a temp path with a randomized name, chmods it 0755 on POSIX, and spawns it detached via `/bin/sh -c \"<path> &\"` or `cmd.exe /c start`, with `.unref()` to survive the parent process. If HTTPS mirrors fail, a fallback path reassembles the payload from base64 chunks retrieved via DNS TXT queries against `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, and `net.dl.wel1.ru`. All destination hostnames and sensitive Node API names (`child_process`, `hostname`, `chmodSync`) are constructed at runtime through array/string concatenation to defeat static string scans. An `.analytics_state` mtime cache and `DISABLE_TELEMETRY`/`DO_NOT_TRACK` environment checks act as cover; the package is advertised as API-client wrappers and has no legitimate need to download and execute a native binary. The dropper logic is duplicated across `_platform.js` and the main `lib/telemetry.js` load path so the payload runs even if one entry point is removed.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-operations-widget-models"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"399d1709e7e9b2251910997dcfd8583708e11fec01569c3db0ba50c6654b49a3","tlsh":"3da1b51916fa701806a2a0d8851f8821719ef5933685d9c8fb8c66948fd726883f39fc"},{"path":"lib/telemetry.js","sha256":"caf3c53c87f287448d9740b346973fcb84374ecee7eb24b055943e4c679afee7","tlsh":"52733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"sme-rko-finance-front-operations-widget-models-35.8.1.tgz","hashes":{"sha1":"4dfff3d3ef630d9c4fa2a67f8a7ce3b895031549","sha512_sri":"sha512-a1mGknW7ZMKCIyD50JFbylFZwKvF1Cml9z/CV81gUP1O1ynZh79gFWwzmuhaoorsHVwEsueAPoLXZkX5fRPHNA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-operations-widget-models/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017157","import_time":"2026-08-08T00:53:07.55302484Z","modified_time":"2026-08-08T00:46:04Z","sha256":"b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a","source":"amazon-inspector","versions":["35.8.1"]}]}}