Malicious code in sme-rko-finance-front-operations-feed-models (npm)

The npm package sme-rko-finance-front-operations-feed-models was found to contain malicious code in its index.js file. Upon package load, the code unconditionally requires a hidden _runtime module that performs malicious operations.

The runtime.js module selects platform-specific endpoints and downloads binary payloads over HTTPS from attacker-controlled hosts, including oob-worker.cf103-070.workers.dev and others on the *.workers.dev domain. A DNS TXT record fallback to sdk.dl.wel1.ru is also configured. The downloaded payloads are written to temporary directories (/tmp or %TEMP%) under decoy filenames impersonating dotnet diagnostics tools (.cache or dotnet_diag_.exe), made executable, and spawned via shell commands.

The malware employs multiple evasion techniques: network destinations are assembled at runtime by joining fragmented string arrays to defeat static analysis, filenames mimic legitimate dotnet tools, and execution is rate-limited via a stamp file. The fetched binaries are opaque native executables unrelated to the package's stated purpose and are entirely under attacker control.

This incident was identified and credited to the OpenSSF malicious-packages project.