Malicious code in sme-rko-finance-front-operations-feed-impl (npm)

The npm package sme-rko-finance-front-operations-feed-impl was found to contain malicious code that executes immediately upon require(). The malware is distributed across two entry points: adapter.js and lib/telemetry.js.\n\nThe attack mechanism involves assembling Cloudflare Workers hostnames from obfuscated string arrays (oob-worker.cf101-adf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev) at runtime. The malware downloads platform-specific binary payloads and writes them to temporary directories with disguised names (dotnet_diag.exe on Windows; hidden.cache_ on Unix), then executes them with elevated permissions (chmod 0755) via cmd.exe or /bin/sh -c with detached process spawning.\n\nWhen HTTPS retrieval fails, the malware falls back to a DNS-based staging channel that resolves TXT records on sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru to reconstruct base64-encoded payloads. The require() of child_process is obfuscated as require("child_"+"process") to evade static analysis, and the package is disguised with an analytics_state marker resembling a Sentry-like telemetry SDK.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.