{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "_platform.js",
              "sha256": "399d1709e7e9b2251910997dcfd8583708e11fec01569c3db0ba50c6654b49a3",
              "tlsh": "3da1b51916fa701806a2a0d8851f8821719ef5933685d9c8fb8c66948fd726883f39fc"
            },
            {
              "path": "lib/telemetry.js",
              "sha256": "caf3c53c87f287448d9740b346973fcb84374ecee7eb24b055943e4c679afee7",
              "tlsh": "52733f4966fb10214263b0685fab40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"
            }
          ],
          "package_integrity": [
            {
              "filename": "sme-rko-finance-front-operations-widget-models-35.8.1.tgz",
              "hashes": {
                "sha1": "4dfff3d3ef630d9c4fa2a67f8a7ce3b895031549",
                "sha512_sri": "sha512-a1mGknW7ZMKCIyD50JFbylFZwKvF1Cml9z/CV81gUP1O1ynZh79gFWwzmuhaoorsHVwEsueAPoLXZkX5fRPHNA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "sme-rko-finance-front-operations-widget-models"
      },
      "versions": [
        "35.8.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017157",
        "import_time": "2026-08-08T00:53:07.55302484Z",
        "modified_time": "2026-08-08T00:46:04Z",
        "sha256": "b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a",
        "source": "amazon-inspector",
        "versions": [
          "35.8.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a)\nOn require of the package, `_platform.js` and `lib/telemetry.js` run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one of three anonymous Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a temp path with a randomized name, chmods it 0755 on POSIX, and spawns it detached via `/bin/sh -c \"\u003cpath\u003e \u0026\"` or `cmd.exe /c start`, with `.unref()` to survive the parent process. If HTTPS mirrors fail, a fallback path reassembles the payload from base64 chunks retrieved via DNS TXT queries against `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, and `net.dl.wel1.ru`. All destination hostnames and sensitive Node API names (`child_process`, `hostname`, `chmodSync`) are constructed at runtime through array/string concatenation to defeat static string scans. An `.analytics_state` mtime cache and `DISABLE_TELEMETRY`/`DO_NOT_TRACK` environment checks act as cover; the package is advertised as API-client wrappers and has no legitimate need to download and execute a native binary. The dropper logic is duplicated across `_platform.js` and the main `lib/telemetry.js` load path so the payload runs even if one entry point is removed.\n",
  "id": "MAL-2026-13652",
  "modified": "2026-08-08T00:46:04Z",
  "published": "2026-08-08T00:46:04Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/sme-rko-finance-front-operations-widget-models/v/35.8.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in sme-rko-finance-front-operations-widget-models (npm)"
}