MAL-2026-13640

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-notifications-impl/MAL-2026-13640.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13640
Published
2026-08-08T00:47:40Z
Modified
2026-08-08T01:05:04.210944736Z
Summary
Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682)

On require(), index.js loads adapter.js which selects a platform-specific payload (linux x64/arm64, darwin, win32) and fetches it from string-split-obfuscated hosts including oob-worker.cf1-01-adf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT fallback over *.dl.wel1.ru. The retrieved bytes are written to a hidden temp file, chmodded to 0755 on POSIX, and executed detached via spawn("/bin/sh", ["-c", filePath + " &"]) or spawn("cmd",...) on Windows. A second parallel dropper exists in the package's main module lib/telemetry.js under an 'analytics SDK' cover story, reproducing the base64/DNS-TXT decode, chmod 0755, and /bin/sh execution path. Hostnames and the string 'childprocess' are assembled at runtime from split arrays (e.g. require("child_" + "process"), ['sdk.dl.wel1.ru'].join(""), ['ext.dl.we','l1.','ru'].join("")) to evade static detection. No signature or hash verification is performed; destinations are not the declared publisher's infrastructure. The package name mimics an internal-looking scope (sme-rko-finance-front-operations-notifications-impl) consistent with a dependency-confusion lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-08T00:47:40Z",
            "source": "amazon-inspector",
            "sha256": "6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682",
            "import_time": "2026-08-08T00:53:08.203909633Z",
            "id": "IN-MAL-2026-017167",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sme-rko-finance-front-operations-notifications-impl

Package

Name
sme-rko-finance-front-operations-notifications-impl
View open source insights on deps.dev
Purl
pkg:npm/sme-rko-finance-front-operations-notifications-impl

Affected ranges

Affected versions

35.*
35.8.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "sme-rko-finance-front-operations-notifications-impl-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-FvziW2Whmi1EV/vnSsoyT+Mn6E34JOkN9pOIvgyKxeAbWgfuVQeqeKKUJZd9yMtsSDHIzO9hkMplooz/l3Gluw==",
                "sha1": "335e4603248e4530fcf9e5eed40ee888757026bb"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "f5a1955a1afb302906d3e1d8841b5816719ae5533284d9d4fb4c66988f9b138c3f39fc",
            "sha256": "0620ce7aec613b40b72c09aaf26e0079b823eb5c906bf71e94c841249f400277",
            "path": "_adapter.js"
        },
        {
            "tlsh": "aa73304966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9",
            "sha256": "f5a456deacee848db71c214204a4fd5729aa1b8ecb8de01897884f3e36ba4594",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-operations-notifications-impl/MAL-2026-13640.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]