{"answers":{"affected":"1 open source package ship an affected version, including sme-rko-finance-front-operations-feed-impl.","exploited":"There is no known exploitation of MAL-2026-13636 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13636 is a malicious package in sme-rko-finance-front-operations-feed-impl, published on 8 Aug 2026."},"fix_prompt":"MAL-2026-13636 is a malicious package: sme-rko-finance-front-operations-feed-impl (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13636/ (Markdown: https://insights.sbomify.com/MAL-2026-13636/index.md)","id":"MAL-2026-13636","markdown":"https://insights.sbomify.com/MAL-2026-13636/index.md","name":"MAL-2026-13636","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require(), _adapter.js and lib/telemetry.js assemble Cloudflare Workers hostnames from string-split arrays (oob-worker.cf101-adf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev) joined at runtime, download a platform-specific binary payload, write it under /tmp or %TEMP% with a disguised name (dotnet_diag_\u003crand\u003e.exe on Windows; hidden.cache_\u003crand\u003e on Unix), chmod 0755 (via the concatenated property name fs['chmod'+'Sync']), and spawn it detached through cmd.exe or /bin/sh -c '\u003cpath\u003e \u0026' with detached:true and unref(). When HTTPS retrieval fails, a DNS-based staging channel resolves TXT records on sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru — reading a chunk count from c.\u003cdomain\u003e and reconstructing a base64 payload from 0.\u003cdomain\u003e..N.\u003cdomain\u003e TXT records. The require of child_process is split as require(\"child_\"+\"process\") and the module is dressed up with an analytics_state cover-story marker resembling a Sentry-like telemetry SDK. Two redundant dropper paths execute on import: _adapter.js and the main entry lib/telemetry.js.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in sme-rko-finance-front-operations-feed-impl (npm)","id":"MAL-2026-13636","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"sme-rko-finance-front-operations-feed-impl","purl":"pkg:npm/sme-rko-finance-front-operations-feed-impl","source":"MAL-2026-13636"}],"products":null,"published":"2026-08-08","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13636/"}