Malicious code in sme-rko-finance-front-operations-fee (npm)
The npm package sme-rko-finance-front-operations-fee contained malicious code that executed a binary dropper at require/import time, fetching and executing platform-specific payloads from attacker-controlled Cloudflare Workers and DNS-TXT fallback channels. Installation or import of the package resulted in remote code execution on the host system.
- Disclosed
- Last updated
- Blast radius
- Any system that installed or required the malicious package version
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-operations-feenpm package containing malicious code
The npm package sme-rko-finance-front-operations-fee contained obfuscated malicious code in its main entry point (./lib/telemetry) and _vendor.js module. The code used string concatenation and array joining to evade static analysis detection of hostnames and API identifiers.
The malicious code implemented a binary dropper that fetched platform-specific executables over HTTPS from anonymous Cloudflare Workers origins (oob-worker.cf103-070.workers.dev, cf100-416.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev), with a base64-encoded DNS-TXT fallback channel over *.dl.wel1.ru domains (e.g., sdk.dl.wel1.ru). The fetched bytes were written to /var/tmp/.cache_ on Linux or %TEMP%\dotnet_diag_.exe on Windows, made executable via chmod 0755, and spawned detached.
No cryptographic pinning or signature verification was implemented, and the download hosts were mutable and anonymous. Simply installing or requiring the package resulted in remote code execution on the installer's system.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Domains
- oob-worker.cf103-070.workers.dev
- cf100-416.workers.dev
- cf99-9b3.workers.dev
- cf101-adf.workers.dev
- sdk.dl.wel1.ru
Remediation
- Immediately uninstall the sme-rko-finance-front-operations-fee package from all systems
- Audit all systems that installed or required this package for signs of compromise, including unexpected processes, network connections, and file modifications in /var/tmp and %TEMP%
- Review npm audit logs and package.json lock files to identify when the malicious package was installed
- Consider the affected systems compromised and perform forensic analysis or reimaging
- Update npm dependencies to remove any references to this package
- Monitor for indicators of compromise from the identified C2 domains and Cloudflare Workers origins
Sources
- GitHub Advisory GHSA-ffh6-w4x4-2j5q · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-operations-fee (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-operations-fee-npm-l3xi8g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit