MAL-2026-13649
Malicious code in sme-rko-finance-front-operations-tax (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa) On require, index.js loads _platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or Windows Temp under disguised names (e.g.,.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to defeat static analysis. The package's stated purpose (finance/tax operations frontend) has no legitimate need to fetch and execute an opaque native binary from non-publisher infrastructure.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for sme-rko-finance-front-operations-tax (npm). Pin to a known-safe version or switch to an alternative.