OpenSSF/OSV advisory MAL-2026-12440 confirms this npm version as malicious. index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection (assembling `oob-worker.cf10[0-3]-*.workers.dev` mirrors plus a DNS-TXT fallback under `*.dl.well1.site`), fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story filenames (`dotnet_diag_*.exe`, `.cache_*`, `.analytics_state`), sets...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)
Details
index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection (assembling `oob-worker.cf10[0-3]-*.workers.dev` mirrors plus a DNS-TXT fallback under `*.dl.well1.site`), fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story filenames (`dotnet_diag_*.exe`, `.cache_*`, `.analytics_state`), sets mode 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` (or the cmd equivalent on Windows). Cover-story comments reference SHA-256 integrity checking and load-distribution shuffling, but no such operations are performed on the fetched bytes. lib/telemetry.js ships duplicate dropper primitives (`Buffer.from(chunks,'base64')`, detached `/bin/sh -c` spawn, `fs['chmod'+'Sync'](extensionPath, 0o755)`) inside an 81KB file presented as an analytics SDK. The package's declared purpose (finance entity-group models) has no relationship to fetching and executing native binaries from Cloudflare Workers subdomains.
Decision reason
OpenSSF Malicious Packages via OSV confirms sme-rko-finance-front-shared-entity-groups-models@20.2.8 as malicious (MAL-2026-12440): Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)