MAL-2026-13637

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-feed-models/MAL-2026-13637.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13637
Published
2026-08-08T00:43:15Z
Modified
2026-08-08T01:05:02.838969136Z
Summary
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc)

index.js unconditionally requires./runtime on package load. runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one of four string-split *.workers.dev hosts (e.g. oob-worker.cf103-070.workers.dev), with a DNS TXT chunked-base64 fallback to sdk.dl.wel1.ru, writes the payload to /tmp or %TEMP% under a decoy name (.cache<hex> or dotnetdiag_<hex>.exe), chmods it 0755, and detach-spawns it via /bin/sh -c or cmd.exe. Network destinations are assembled at runtime by joining fragmented string arrays to evade static analysis, filenames impersonate dotnet diagnostics, and execution is rate-limited via a stamp file in /tmp. The fetched bytes are attacker-controlled opaque native executables unrelated to the package's stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.1"
            ],
            "import_time": "2026-08-08T00:53:06.140661616Z",
            "sha256": "13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc",
            "modified_time": "2026-08-08T00:43:15Z",
            "id": "IN-MAL-2026-017138",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / sme-rko-finance-front-operations-feed-models

Package

Name
sme-rko-finance-front-operations-feed-models
View open source insights on deps.dev
Purl
pkg:npm/sme-rko-finance-front-operations-feed-models

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-geNo+FO43X7zY77GlYObF/t2IYgZyXQL7rBhgXTBIBe1VZN4akH7A913+AMwqjadfeRrRqg4W3zw8MkAdcxB8g==",
                "sha1": "3f2143dab94253548a983c881fbeac7d57edd72f"
            },
            "filename": "sme-rko-finance-front-operations-feed-models-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "sha256": "0b170eaec8c7340e2ab4efe19b8ed76c94e2d998c3d74be48f3af5de566432c4",
            "tlsh": "c2a1965516fa70280b92e1d4851f8816729bf9933684d5c4f78c26548fd763983b3dec"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-feed-models/MAL-2026-13637.json"