MAL-2026-13656

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models/MAL-2026-13656.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13656
Published
2026-08-08T00:44:01Z
Modified
2026-08-08T01:04:51.996146978Z
Summary
Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637)

On require, index.js loads bridge.js which selects a platform-specific asset path (linuxx64, linuxarm64, darwin, win32), downloads bytes from a rotating set of Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT discovery fallback under *.dl.wel1.ru, writes the payload under /var/tmp or the Windows TEMP directory using disguised names impersonating dotnetdiag and hidden dotfiles, chmods it to 0755, and detached-spawns it via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names (child_process, chmodSync) are reconstructed at runtime from split-string fragments to evade static inspection. lib/telemetry.js contains a parallel dropper (base64 chunk assembly, split-property fs.chmodSync, cp.spawn of /bin/sh) reachable from the main entry, redundantly staging payload delivery. A filesystem stamp implements run-once deduplication.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017143",
            "import_time": "2026-08-08T00:53:06.505529946Z",
            "sha256": "b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637",
            "modified_time": "2026-08-08T00:44:01Z",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models

Package

Name
sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models
View open source insights on deps.dev
Purl
pkg:npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Hzk2pao5qy0cM3MrDWFX0Ud2aWN+GCyP1IXQmsgd0ZehOD6van8+TYN/YxQuHoQnqHyCdr3GVZQLCNTydx2qYQ==",
                "sha1": "c9a48026daff19e24416450aa8babe4e90b15c2c"
            },
            "filename": "sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_bridge.js",
            "sha256": "bd06c971ebea554ff40d450f83a0318c2006a6b8a85782d1903eeed2872edc35",
            "tlsh": "dda1b64a26fb30180693b1d4851f4426b1aaf6433384d9d4fb4c66949fa627983f3afc"
        },
        {
            "sha256": "f0ef9622311ba1dff987b237aaea820b27dfb12815c958eab6cf645d89c4cb5c",
            "path": "lib/telemetry.js",
            "tlsh": "ce733f4966fb10214263b0685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models/MAL-2026-13656.json"