sme-rko-finance-front-payments-feed-display-list-impl

{"modified":"2026-08-08T00:45:56Z","published":"2026-08-08T00:45:56Z","schema_version":"1.7.4","id":"MAL-2026-13663","summary":"Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4e33cae8840b73256d5d48935bfa7b8490ea7a36d56edeff8adfc4ca19dfea49)\nOn require(), index.js loads _helpers.js which selects a platform-specific endpoint, downloads a binary from one of three string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a hidden path (/tmp/.cache_<rand> or %TEMP%\\dotnet_diag_<rand>.exe), chmods 0755, and spawns it detached with stdio ignored via cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"], {detached:true, stdio:\"ignore\"}).unref(). A secondary fetch-and-execute path in lib/telemetry.js (loaded from index.js) duplicates the same logic with base64 chunked payload assembly, cp.spawn of the downloaded file, and fs[\"chmod\"+\"Sync\"] with 0755. A DNS TXT chunked-base64 fallback resolves *.dl.wel1.ru subdomains to reconstruct the payload or endpoint when direct HTTPS is unavailable. Hostnames, the child_process module name, and the chmodSync API are all assembled via array.join / string concatenation to evade static analysis, and cache filenames (.analytics_state, dotnet_diag_*.exe) are chosen to blend in. The package's stated purpose is an API client wrapper, which does not require fetching or executing native binaries.\n","affected":[{"package":{"ecosystem":"npm","name":"sme-rko-finance-front-payments-feed-display-list-impl"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"ee4e06750a0e6d2679e791472dc87764a052b10b630b2f8ee614d9321a43800b","tlsh":"b5a194592bfa70180692f1d4841f882a719ef6933685e8c4fb4c66548fe7224c3b29fd"},{"path":"lib/telemetry.js","sha256":"84dc9787b6601536b10fef9edce5f1523986740f6988d703ef542788a1e86b8a","tlsh":"2073304966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"sme-rko-finance-front-payments-feed-display-list-impl-35.8.1.tgz","hashes":{"sha1":"51fbcc4c281a94f41e44645becedf91febc346e8","sha512_sri":"sha512-a3UP2o577rrwejnCYcQIepIU4LT24cc2Bhm5xS36AaZRdvLr4XNTtLeRMxyA99nSpMdgLDiGDfzXTKMbxc9haw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-payments-feed-display-list-impl/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017156","import_time":"2026-08-08T00:53:07.471068969Z","modified_time":"2026-08-08T00:45:56Z","sha256":"4e33cae8840b73256d5d48935bfa7b8490ea7a36d56edeff8adfc4ca19dfea49","source":"amazon-inspector","versions":["35.8.1"]}]}}