Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)
The npm package sme-rko-finance-front-operations-notifications-impl contained malicious code that executed platform-specific payloads fetched from attacker-controlled infrastructure upon installation. The package used obfuscation and dependency-confusion tactics to evade detection and mimic internal naming conventions.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious package versions
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-operations-notifications-implMalicious npm package
The npm package sme-rko-finance-front-operations-notifications-impl was found to contain malicious code designed to execute arbitrary payloads on installation. The attack employed multiple evasion techniques, including runtime string obfuscation to hide hostnames and require statements from static analysis.
Upon installation, the package's index.js loads _adapter.js, which detects the target platform (Linux x64/arm64, macOS, or Windows) and fetches a corresponding payload from attacker-controlled domains including oob-worker.cf1-01-adf.workers.dev and sdk.dl.wel1.ru. A secondary dropper exists in lib/telemetry.js, disguised as an 'analytics SDK'. Both mechanisms retrieve and execute payloads without signature or hash verification.
The retrieved bytes are written to hidden temporary files, made executable (chmod 0755 on POSIX systems), and executed via shell spawning (/bin/sh on Unix, cmd on Windows). Hostnames and module names are assembled at runtime from split arrays to evade static detection. The package name itself mimics internal corporate naming conventions, consistent with a dependency-confusion attack targeting developers who might expect such a package from an internal registry.
The malicious package was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Domains
- oob-worker.cf1-01-adf.workers.dev
- sdk.dl.wel1.ru
- dl.wel1.ru
Remediation
- Immediately uninstall sme-rko-finance-front-operations-notifications-impl from all systems and projects
- Audit npm package.json and lock files for any presence of this package
- Review system logs and process execution history on any machine that installed this package for signs of unauthorized activity
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Implement npm package allow-listing or use private registries to prevent dependency-confusion attacks
- Monitor for connections to the identified malicious domains (oob-worker.cf1-01-adf.workers.dev, sdk.dl.wel1.ru)
Sources
- GitHub Advisory GHSA-45vf-qpf8-q2pq · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-operations-notifications-impl-npm-3dtig9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
npmCompromised packageDependency confusion