MAL-2026-13647 Malicious code in sme-rko-finance-front-operations-shared (npm)

On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js reconstructs hardcoded hosts via array-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS-TXT chunked fallback under *.dl.wel1.ru), fetches a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache<rnd> / dotnet_diag<rnd>.exe), chmods 0o755 on POSIX, and detached-spawns it via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref(). Sensitive APIs are also obfuscated (require('child_'+'process'), fs['chmod'+'Sync']) to evade string-based scanners, and markerFresh() rate-limits re-execution. lib/telemetry.js (the module actually exported from index.js) contains a parallel dropper that base64-decodes embedded chunks, writes them to disk, chmods 0o755 via the same obfuscated accessor, and detached-spawns them through /bin/sh. The package presents as "analytics" but ships two independent import-time RCE paths delivering attacker-controlled binaries from anonymous Cloudflare workers.dev endpoints and a Russian lookalike TLD, unpinned and unverified.