sme-rko-finance-front-operations-tax

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa)
On require, index.js loads _platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or Windows Temp under disguised names (e.g.,.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to defeat static analysis. The package's stated purpose (finance/tax operations frontend) has no legitimate need to fetch and execute an opaque native binary from non-publisher infrastructure.

Compromised versions (1)

• 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.