sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637)
On require, index.js loads _bridge.js which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32), downloads bytes from a rotating set of Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT discovery fallback under *.dl.wel1.ru, writes the payload under /var/tmp or the Windows TEMP directory using disguised names impersonating dotnet_diag and hidden dotfiles, chmods it to 0755, and detached-spawns it via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names (child_process, chmodSync) are reconstructed at runtime from split-string fragments to evade static inspection. lib/telemetry.js contains a parallel dropper (base64 chunk assembly, split-property fs.chmodSync, cp.spawn of /bin/sh) reachable from the main entry, redundantly staging payload delivery. A filesystem stamp implements run-once deduplication.

Compromised versions (1)

• 35.8.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.