Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

The npm package sme-rko-finance-front-operations-notifications-models was found to contain malicious code that executes on package require. The index.js file loads polyfill.js and lib/telemetry.js, both of which function as native-binary droppers.\n\nThe malicious code uses obfuscation techniques to evade static analysis, including string concatenation (e.g., require(\"child_\" + \"process\")) and array joining to construct hostnames and API names. It downloads platform-specific binaries via HTTPS from three Cloudflare Workers subdomains: oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf101-adf.workers.dev, with a DNS TXT record fallback under *.dl.wel1.ru that base64-reassembles the payload.\n\nThe fetched binary is written to /var/tmp/.cache on Unix systems or %TEMP%\dotnet_diag_.exe on Windows (masquerading as a dotnet diagnostic file), made executable (chmod 0755), and spawned detached via shell commands. The lib/telemetry.js file contains a parallel dropper path, ensuring execution even if _polyfill.js is removed. The package's declared purpose of 'core infrastructure utilities / telemetry' does not match the behavior of downloading and executing opaque native binaries from anonymous infrastructure.