sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models

{"modified":"2026-08-08T00:44:01Z","published":"2026-08-08T00:44:01Z","schema_version":"1.7.4","id":"MAL-2026-13656","summary":"Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637)\nOn require, index.js loads _bridge.js which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32), downloads bytes from a rotating set of Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT discovery fallback under *.dl.wel1.ru, writes the payload under /var/tmp or the Windows TEMP directory using disguised names impersonating dotnet_diag and hidden dotfiles, chmods it to 0755, and detached-spawns it via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names (child_process, chmodSync) are reconstructed at runtime from split-string fragments to evade static inspection. lib/telemetry.js contains a parallel dropper (base64 chunk assembly, split-property fs.chmodSync, cp.spawn of /bin/sh) reachable from the main entry, redundantly staging payload delivery. A filesystem stamp implements run-once deduplication.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"bd06c971ebea554ff40d450f83a0318c2006a6b8a85782d1903eeed2872edc35","tlsh":"dda1b64a26fb30180693b1d4851f4426b1aaf6433384d9d4fb4c66949fa627983f3afc"},{"path":"lib/telemetry.js","sha256":"f0ef9622311ba1dff987b237aaea820b27dfb12815c958eab6cf645d89c4cb5c","tlsh":"ce733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models-35.8.1.tgz","hashes":{"sha1":"c9a48026daff19e24416450aa8babe4e90b15c2c","sha512_sri":"sha512-Hzk2pao5qy0cM3MrDWFX0Ud2aWN+GCyP1IXQmsgd0ZehOD6van8+TYN/YxQuHoQnqHyCdr3GVZQLCNTydx2qYQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017143","import_time":"2026-08-08T00:53:06.505529946Z","modified_time":"2026-08-08T00:44:01Z","sha256":"b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637","source":"amazon-inspector","versions":["35.8.1"]}]}}