{"answers":{"affected":"1 open source package ship an affected version, including sme-rko-finance-front-operations-shared.","exploited":"There is no known exploitation of MAL-2026-13647 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13647 is a malicious package in sme-rko-finance-front-operations-shared, published on 8 Aug 2026."},"fix_prompt":"MAL-2026-13647 is a malicious package: sme-rko-finance-front-operations-shared (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13647/ (Markdown: https://insights.sbomify.com/MAL-2026-13647/index.md)","id":"MAL-2026-13647","markdown":"https://insights.sbomify.com/MAL-2026-13647/index.md","name":"MAL-2026-13647","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require/import, index.js loads./_bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. _bootstrap.js reconstructs hardcoded hosts via array-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS-TXT chunked fallback under *.dl.wel1.ru), fetches a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache_\u003crnd\u003e / dotnet_diag_\u003crnd\u003e.exe), chmods 0o755 on POSIX, and detached-spawns it via cp.spawn('/bin/sh',['-c', fp+' \u0026'],{detached:true}).unref(). Sensitive APIs are also obfuscated (require('child_'+'process'), fs['chmod'+'Sync']) to evade string-based scanners, and markerFresh() rate-limits re-execution. lib/telemetry.js (the module actually exported from index.js) contains a parallel dropper that base64-decodes embedded chunks, writes them to disk, chmods 0o755 via the same obfuscated accessor, and detached-spawns them through /bin/sh. The package presents as \"analytics\" but ships two independent import-time RCE paths delivering attacker-controlled binaries from anonymous Cloudflare workers.dev endpoints and a Russian lookalike TLD, unpinned and unverified.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in sme-rko-finance-front-operations-shared (npm)","id":"MAL-2026-13647","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"sme-rko-finance-front-operations-shared","purl":"pkg:npm/sme-rko-finance-front-operations-shared","source":"MAL-2026-13647"}],"products":null,"published":"2026-08-08","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13647/"}