sme-rko-finance-front-operations-tax @35.8.1
Vulnerability report · Last retrieved from osv.dev August 8, 2026 at 5:15 AM UTC
OSV ID
MAL-2026-13649
Ecosystem
npm
Summary
On require, index.js loads _platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or Windows Temp under disguised names (e.g.,.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to defeat static analysis. The package's stated purpose (finance/tax operations frontend) has no legitimate need to fetch and execute an opaque native binary from non-publisher infrastructure.
Source: amazon-inspector (ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.