Malicious code in sme-rko-finance-front-operations-domain (npm)

The npm package sme-rko-finance-front-operations-domain was found to contain malicious code that executes automatically upon require. The index.js file loads shim.js, which contains an async initializer that assembles platform-specific hostnames from split-string arrays to target attacker-controlled endpoints: oob-worker.cf102-baf.workers.dev and sdk/ext/pkg/net.dl.wel1.ru.\n\nThe malicious code downloads native binaries over HTTPS and writes them to temporary directories (/tmp or %TEMP%) under disguised names such as .cache or dotnet_diag_.exe. The files are then made executable (chmod 0755) and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start /b). A secondary execution path exists in lib/telemetry.js, presented as an observability/Sentry-like SDK, which contains identical dropper primitives.\n\nTo evade static analysis, child_process, chmodSync, and endpoint hostnames are reconstructed at runtime from concatenated string fragments. The fetched binaries are unsigned and unverifiable, with no integrity checks or pinned publisher-owned sources. A DNS-TXT fallback channel (dns.resolveTxt) reassembles and base64-decodes payloads when HTTPS retrieval fails, allowing the attack to bypass HTTP egress controls.\n\nThe malicious package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-4rj4-828w-hv35."