🛡️ MAL-2026-12441 — sme-scripts-shared-library-webpack-plugi

Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

Source: amazon-inspector

[email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from a rotating list of *.workers.dev hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev), with a DNS-TXT chunked base64 fallback channel over *.dl.well1.site (tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). Fetched bytes are written to /tmp or %TEMP% under decoy names ('.cache_<rnd>' on POSIX, 'dotnet_diag_<rnd>.exe' on Windows), chmod 755, and launched detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe. Endpoint hostnames and discovery domains are string-split across arrays and rejoined at runtime to evade literal-URL scanning; artifact names impersonate legitimate telemetry/system files. lib/telemetry.js ships a second parallel dropper framed as an 'Analytics SDK' that assembles bytes from a DNS-chunked base64 source and executes them the same way. No hash or signature verification is performed on any fetched payload.