Malicious code in sme-rko-finance-front-operations-other (npm)

The npm package sme-rko-finance-front-operations-other was found to contain malicious code designed to download and execute arbitrary binaries. The attack was discovered via Amazon Inspector and credited to the OpenSSF malicious-packages project.\n\nThe malicious payload is distributed across two files: init.js and lib/telemetry.js. On require() or import, init.js selects an OS/architecture-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback mechanism using domains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to temporary directories (/var/tmp on Unix, Windows TEMP on Windows) under disguised filenames (dotnet_diag*.exe, .cache*), made executable (chmod 0755), and spawned detached via /bin/sh or cmd.\n\nA second dropper in lib/telemetry.js, loaded as the main export within a decoy Sentry-like SDK bundle, base64-decodes downloaded bytes, applies executable permissions via dynamically constructed property names, and spawns the resulting file detached. The package employed runtime string obfuscation (e.g., concatenating fragments like "child_"+"process") to defeat static analysis. No cryptographic pinning, hash verification, or signature validation was present, and the delivered content bore no relation to any documented package purpose.\n\nThe package was identified and reported through the OpenSSF malicious-packages repository.