Malicious code in sme-scripts-shared-library-webpack-plugin (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9) [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from a rotating list of *.workers.dev hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev), with a DNS-TXT chunked base64 fallback channel over *.dl.well1.site (tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). Fetched bytes are written to /tmp or %TEMP% under decoy names ('.cache_<rnd>' on POSIX, 'dotnet_diag_<rnd>.exe' on Windows), chmod 755, and launched detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe. Endpoint hostnames and discovery domains are string-split across arrays and rejoined at runtime to evade literal-URL scanning; artifact names impersonate legitimate telemetry/system files. lib/telemetry.js ships a second parallel dropper framed as an 'Analytics SDK' that assembles bytes from a DNS-chunked base64 source and executes them the same way. No hash or signature verification is performed on any fetched payload. ## Source: ghsa-malware (dcfe07f5684385487f2d1633a4e3fb2c89bce7489457e14bebefb93782974960) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The [email protected] performs an install/import-time dropper operation. Upon module load, it requires a setup script that selects a platform-specific binary asset (linux_x64, linux_arm64, darwin, win32) and downloads it over HTTPS from a rotating set of *.workers.dev hosts. If that fails, it uses a DNS TXT record channel with base64 chunking from *.dl.well1.site domains as a fallback. The downloaded payload is saved to temporary directories with names mimicking legitimate telemetry or system files, made executable, and launched detached via shell commands. Additionally, a telemetry.js module acts as a parallel dropper, fetching and executing code similarly. No hash or signature verification is performed on any payload, increasing risk of executing malicious code.
Potential Impact
This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or further malware deployment. The use of obfuscated domains and fallback DNS channels complicates detection and blocking. The lack of integrity checks on downloaded payloads increases the risk of executing tampered or malicious code.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid using sme-scripts-shared-library-webpack-plugin version 20.2.9 and remove it from their environments. Monitor for any unexpected binaries running from temporary directories with suspicious names. Employ network controls to block the identified malicious domains if possible. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Malicious code in sme-scripts-shared-library-webpack-plugin (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9) [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from a rotating list of *.workers.dev hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev), with a DNS-TXT chunked base64 fallback channel over *.dl.well1.site (tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). Fetched bytes are written to /tmp or %TEMP% under decoy names ('.cache_<rnd>' on POSIX, 'dotnet_diag_<rnd>.exe' on Windows), chmod 755, and launched detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe. Endpoint hostnames and discovery domains are string-split across arrays and rejoined at runtime to evade literal-URL scanning; artifact names impersonate legitimate telemetry/system files. lib/telemetry.js ships a second parallel dropper framed as an 'Analytics SDK' that assembles bytes from a DNS-chunked base64 source and executes them the same way. No hash or signature verification is performed on any fetched payload. ## Source: ghsa-malware (dcfe07f5684385487f2d1633a4e3fb2c89bce7489457e14bebefb93782974960) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The [email protected] performs an install/import-time dropper operation. Upon module load, it requires a setup script that selects a platform-specific binary asset (linux_x64, linux_arm64, darwin, win32) and downloads it over HTTPS from a rotating set of *.workers.dev hosts. If that fails, it uses a DNS TXT record channel with base64 chunking from *.dl.well1.site domains as a fallback. The downloaded payload is saved to temporary directories with names mimicking legitimate telemetry or system files, made executable, and launched detached via shell commands. Additionally, a telemetry.js module acts as a parallel dropper, fetching and executing code similarly. No hash or signature verification is performed on any payload, increasing risk of executing malicious code.
Potential Impact
This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or further malware deployment. The use of obfuscated domains and fallback DNS channels complicates detection and blocking. The lack of integrity checks on downloaded payloads increases the risk of executing tampered or malicious code.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid using sme-scripts-shared-library-webpack-plugin version 20.2.9 and remove it from their environments. Monitor for any unexpected binaries running from temporary directories with suspicious names. Employ network controls to block the identified malicious domains if possible. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12441
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735747bf8831d53915a085
Added to database: 08/05/2026, 15:31:19 UTC
Last enriched: 08/05/2026, 17:35:37 UTC
Last updated: 09/12/2026, 06:34:44 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.