Malicious code in sme-rko-finance-front-operations-shared (npm)
The npm package sme-rko-finance-front-operations-shared contained malicious code that executes remote binary payloads on require/import. Two independent dropper mechanisms in _bootstrap.js and lib/telemetry.js fetch and execute platform-specific binaries from Cloudflare Workers and Russian DNS infrastructure without verification.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed or required the malicious sme-rko-finance-front-operations-shared package would execute arbitrary attacker-controlled binaries at import time.
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-operations-sharednpm package containing malicious code in index.js, _bootstrap.js, and lib/telemetry.js
The npm package sme-rko-finance-front-operations-shared was found to contain malicious code that executes on import. The package presents itself as an analytics library but contains two independent remote code execution (RCE) paths.
The first dropper is located in _bootstrap.js, which uses array-join obfuscation to reconstruct hardcoded command-and-control domains (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback under *.dl.wel1.ru. It fetches platform-specific binaries via HTTPS, writes them to temporary directories (/var/tmp on POSIX or %TEMP% on Windows) under disguised names, sets executable permissions (0o755), and spawns them detached via shell.
The second dropper in lib/telemetry.js (the module exported from index.js) uses base64-encoded embedded chunks, writes them to disk, sets executable permissions, and spawns them through /bin/sh. Both mechanisms use obfuscated API calls (e.g., require('child_'+'process'), fs['chmod'+'Sync']) to evade string-based detection, and include rate-limiting via markerFresh() to prevent repeated execution.
The package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-pp5j-rx3f-4m7x.
Indicators of compromise
- Packages
- sme-rko-finance-front-operations-shared
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf103-070.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately remove sme-rko-finance-front-operations-shared from all projects and dependencies
- Audit npm package.json and lock files for any presence of this package
- Review and revoke any credentials or secrets that may have been exposed on systems where this package was installed
- Scan systems that installed this package for unexpected binaries in /var/tmp, %TEMP%, or other temporary directories
- Monitor for suspicious outbound connections to oob-worker.cf*.workers.dev or *.dl.wel1.ru domains
- Update to a clean version if a legitimate replacement is available, or remove the dependency entirely
Sources
- GitHub Advisory GHSA-pp5j-rx3f-4m7x · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-operations-shared (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-operations-shared-npm-1te1t0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - activecritical
Malware in gator-client
The npm package gator-client contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in banana-stand
The npm package banana-stand contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in reseller-app
Malware discovered in the npm package reseller-app. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package