MAL-2026-13642
Dashboard / Malicious Package / MAL-2026-13642
MAL-2026-13642
Summary: Malicious code in sme-rko-finance-front-operations-other (npm)
Details: Source: amazon-inspector (c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be) On require()/import, _init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written under disguised names (dotnet_diag_*.exe,.cache_*) to /var/tmp or Windows TEMP, chmod'd 0755, and spawned detached via /bin/sh or cmd. A second dropper in lib/telemetry.js (loaded as the main export inside a decoy Sentry-like SDK bundle) base64-decodes downloaded bytes, chmods 0755 via a dynamically constructed property name ("chmod"+"Sync"), and spawns the resulting file detached. Hostnames and dangerous API names are assembled from split string fragments at runtime ("child_"+"process",.join("") over host fragments) to defeat static analysis. No pinning, no hash or signature verification, and the delivered content is opaque and unrelated to any documented package purpose.
Affected packages
Package
Name: sme-rko-finance-front-operations-other
Purl: pkg:npm/sme-rko-finance-front-operations-other
Affected ranges
Type: N/A
Events:
