{"id":"MAL-2026-13637","summary":"Malicious code in sme-rko-finance-front-operations-feed-models (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc)\nindex.js unconditionally requires./_runtime on package load. _runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one of four string-split *.workers.dev hosts (e.g. oob-worker.cf103-070.workers.dev), with a DNS TXT chunked-base64 fallback to sdk.dl.wel1.ru, writes the payload to /tmp or %TEMP% under a decoy name (.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe), chmods it 0755, and detach-spawns it via /bin/sh -c or cmd.exe. Network destinations are assembled at runtime by joining fragmented string arrays to evade static analysis, filenames impersonate dotnet diagnostics, and execution is rate-limited via a stamp file in /tmp. The fetched bytes are attacker-controlled opaque native executables unrelated to the package's stated purpose.\n","modified":"2026-08-08T01:05:02.838969136Z","published":"2026-08-08T00:43:15Z","database_specific":{"malicious-packages-origins":[{"sha256":"13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc","source":"amazon-inspector","versions":["35.8.1"],"id":"IN-MAL-2026-017138","import_time":"2026-08-08T00:53:06.140661616Z","modified_time":"2026-08-08T00:43:15Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sme-rko-finance-front-operations-feed-models/v/35.8.1"}],"affected":[{"package":{"name":"sme-rko-finance-front-operations-feed-models","ecosystem":"npm","purl":"pkg:npm/sme-rko-finance-front-operations-feed-models"},"versions":["35.8.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-feed-models/MAL-2026-13637.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"c2a1965516fa70280b92e1d4851f8816729bf9933684d5c4f78c26548fd763983b3dec","path":"_runtime.js","sha256":"0b170eaec8c7340e2ab4efe19b8ed76c94e2d998c3d74be48f3af5de566432c4"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-geNo+FO43X7zY77GlYObF/t2IYgZyXQL7rBhgXTBIBe1VZN4akH7A913+AMwqjadfeRrRqg4W3zw8MkAdcxB8g==","sha1":"3f2143dab94253548a983c881fbeac7d57edd72f"},"filename":"sme-rko-finance-front-operations-feed-models-35.8.1.tgz"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}