🛡️ MAL-2026-12440 — sme-rko-finance-front-shared-entity-grou

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

Source: amazon-inspector

index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection (assembling oob-worker.cf10[0-3]-*.workers.dev mirrors plus a DNS-TXT fallback under *.dl.well1.site), fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story filenames (dotnet_diag_*.exe, .cache_*, .analytics_state), sets mode 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) (or the cmd equivalent on Windows). Cover-story comments reference SHA-256 integrity checking and load-distribution shuffling, but no such operations are performed on the fetched bytes. lib/telemetry.js ships duplicate dropper primitives (Buffer.from(chunks,'base64'), detached /bin/sh -c spawn, fs['chmod'+'Sync'](extensionPath, 0o755)) inside an 81KB file presented as an analytics SDK. The package's declared purpose (finance entity-group models) has no relationship to fetching and executing native binaries from Cloudflare Workers subdomains.