sme-rko-finance-front-payments-feed-adapter

{"modified":"2026-08-08T00:47:10Z","published":"2026-08-08T00:47:10Z","schema_version":"1.7.4","id":"MAL-2026-13661","summary":"Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220)\nThe package is advertised as a finance/payments adapter but on require() reaches a staged loader. `_adapter.js` reconstructs destination hostnames from split array literals (e.g., `['oob-worker.','cf101-adf.workers.d','ev'].join('')`) to hide `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf103-070.workers.dev`, `oob-worker.cf100-416.workers.dev`, and `oob-worker.cf99-9b3.workers.dev`, with a DNS TXT chunked-fallback channel to `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, and `net.dl.wel1.ru`. A platform-specific asset (`/pkg/package`, `/pkg/package.exe`, or `/pkg/package_mac`) is downloaded, written to `/var/tmp/.cache_<hex>` or Windows TEMP `dotnet_diag_<hex>.exe` to masquerade as a system diagnostic, chmod 0755, and spawned detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref()`. A stamp file gates re-runs. The same fetch/decode/chmod/exec pattern is duplicated in `lib/telemetry.js` — the module exposed as `index.js`'s public API — using `require('child_' + 'process')`, `Buffer.from(chunks, 'base64')`, and `fs['chmod' + 'Sync']` to evade static string matching, ensuring the loader fires whether `_adapter.js` or `telemetry.js` is loaded first. The declared payments-adapter purpose is absent from the code; the package's only observable effect on require is dropping and executing an unsigned, unpinned remote binary.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-payments-feed-adapter"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"f29b7d8188376d4dabb46542cca9ea412074e93bb2950d88b38012e37bd6b576","tlsh":"dba1945516fa30180392e5c4851fa816719af6937284d9d4fb4ca6885fdb278c3f3afc"},{"path":"lib/telemetry.js","sha256":"76596f24830b23e050abcc145312bbb7330c86ed6f1803fcd96a5e6e1ab6a908","tlsh":"9f733f4966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"sme-rko-finance-front-payments-feed-adapter-35.8.1.tgz","hashes":{"sha1":"587bacd1093c3ad8ab62dd1c166cdc138fc9d8f7","sha512_sri":"sha512-vbloSwbF9XqQTBiaamkzCfUWXO+BECVnnkHrOjOBVbbga8VYYMbLBnMoAqkixF/UXepAJM7Y4RNVW7DNLISyOA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-payments-feed-adapter/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017164","import_time":"2026-08-08T00:53:08.009901883Z","modified_time":"2026-08-08T00:47:10Z","sha256":"05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220","source":"amazon-inspector","versions":["35.8.1"]}]}}