sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl

{"modified":"2026-08-08T00:43:23Z","published":"2026-08-08T00:43:23Z","schema_version":"1.7.4","id":"MAL-2026-13655","summary":"Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd)\nOn require() of the package, index.js loads _bootstrap.js which selects a payload path based on process.platform/arch (linux_x64, linux_arm64, darwin, win32), downloads an executable over HTTPS from one of several Cloudflare Workers subdomains whose hostnames are assembled at runtime via array-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT base64 chunked fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a disguised name, chmod 755, and spawned detached via /bin/sh -c or cmd.exe. The package.json describes the module as \"API client wrappers\" for an internal payments module, but the on-load behavior is unrelated OS-branched remote code execution. Hostname obfuscation via array-join and a DNS-TXT fallback resolver are deliberate evasion of static string scanners.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"7737fa694684bd6964263fc930a04c8fd799a0c93e290cddd774928414ac43e2","tlsh":"a8a1a71916fa30180792e0d5891b6816b19bf59332c4e9d4f74c66948fd766883f3eec"},{"path":"package.json","sha256":"343a9dbdaf3c29976e0979579be54b5e7bce8daa750b9e5b6eec50295cee85c9","tlsh":"7ee086102aa2993354ca06160c6592676230ce6b40447c0d33df152c469e5b759fa31b"}],"package_integrity":[{"filename":"sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl-35.8.1.tgz","hashes":{"sha1":"1da86874e5cccdfb6b552b0627ba2ee4b3cef845","sha512_sri":"sha512-CqIDiWtw/dB6eQWsKP5Hhe0QWXIfTbvN/Qhr5mNFYRJp3LpLPr0tF47OkcgnNCtD7nJELm08HWd1nhepgxZWGg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017139","import_time":"2026-08-08T00:53:06.208542286Z","modified_time":"2026-08-08T00:43:23Z","sha256":"4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd","source":"amazon-inspector","versions":["35.8.1"]}]}}