MAL-2026-13639

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-income/MAL-2026-13639.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13639
Published
2026-08-08T00:43:51Z
Modified
2026-08-08T01:05:01.430879179Z
Summary
Malicious code in sme-rko-finance-front-operations-income (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a)

On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, and sdk/ext/pkg/net.dl.wel1.ru), downloads a platform-specific native executable over HTTPS, writes it to /var/tmp under a hidden dotfile name on Unix or to the Windows temp directory as dotnetdiag_<hex>.exe, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd /c start. A fallback retrieval path resolves DNS TXT records at c.<domain> and N.<domain>, base64-decodes and reassembles the chunks into the same executable blob, and writes it to disk for execution — a covert delivery channel that bypasses HTTPS-based network filtering. The package is advertised as a monitoring/observability SDK but ships no functionality matching that purpose; the sole import-time effect is dropping and running an opaque author-controlled binary. Hostname obfuscation via.join(''), masquerade filenames imitating.NET diagnostics tooling, detached spawn, and a DNS-TXT covert channel are consistent with a supply-chain remote code execution dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017142",
            "sha256": "7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a",
            "import_time": "2026-08-08T00:53:06.40744275Z",
            "modified_time": "2026-08-08T00:43:51Z",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sme-rko-finance-front-operations-income

Package

Name
sme-rko-finance-front-operations-income
View open source insights on deps.dev
Purl
pkg:npm/sme-rko-finance-front-operations-income

Affected ranges

Affected versions

35.*
35.8.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-income/MAL-2026-13639.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "15a1755926ff60180693e2d4852f9416719afa5333c4d9d4fb4c76984f9a13883b29fc",
            "sha256": "e929954cac5740fbcf731ab3a096d8cae8a441a2196d073f9360cf64a38f3188",
            "path": "_compat.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "sme-rko-finance-front-operations-income-35.8.1.tgz",
            "hashes": {
                "sha1": "ffee4c102bee6ec00d3e342a5842fe419896f507",
                "sha512_sri": "sha512-oZOvkf7bWrg1zoCot1FZ22IQSTaCURC9GCe+Q2GYulu6AtjiamrYVQBywGB6hryviFBYJrLJur62RnSbzoHuJA=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]