MAL-2026-13645
Malicious code in sme-rko-finance-front-operations-penalty (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887) On require() of the package, _runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames (oob-worker.cf103-07/cf99-9b3/cf100-416/cf101-adf.workers.dev) from split string arrays, fetch a platform-specific binary from /pkg/package[-arm64|.exe|loader_mac], write it to /var/tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. A DNS TXT chunked-base64 fallback channel to *.dl.wel1.ru is used when HTTPS fails. Obfuscation techniques include string-split concatenation of host names, dynamic require("child_" + "process"), bracket-notation fs["chmod" + "Sync"], and disguised filenames masquerading as system diagnostics (dotnet_diag,.analytics_state,.cache_*). Both the auxiliary _runtime.js and the main entrypoint lib/telemetry.js reachable via index.js contain the dropper primitives, ensuring execution on import.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for sme-rko-finance-front-operations-penalty (npm). Pin to a known-safe version or switch to an alternative.