Malicious code in sme-rko-finance-front-operations-special-payments (npm)
The npm package sme-rko-finance-front-operations-special-payments contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure upon require(). The package employed obfuscation techniques to evade static analysis and included dual dropper paths in both index.js and lib/telemetry.js.
- Disclosed
- Last updated
- Blast radius
- Any application that requires sme-rko-finance-front-operations-special-payments; payload execution occurs at package load time.
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-operations-special-paymentsnpm package containing malicious dropper code
The npm package sme-rko-finance-front-operations-special-payments was found to contain malicious code that executes automatically when the package is required. Upon loading, the package's index.js file downloads platform-specific binaries from attacker-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS TXT chunked-transfer fallback to *.dl.wel1.ru.\n\nThe downloaded payload is written to the filesystem with obfuscated names (.cache_ on Unix-like systems, dotnet_diag_.exe on Windows), given execute permissions (0755), and spawned as a detached process via shell commands. The package employed multiple obfuscation techniques including runtime construction of C2 hostnames and dangerous API names via array-join and string concatenation to defeat static analysis.\n\nA second dropper path was discovered in the declared main module lib/telemetry.js, disguised as an 'analytics SDK', which base64-decodes transport chunks before executing the resulting binary using the same mechanism. Both dropper paths execute at library load time, meaning any application requiring this package would trigger the malicious behavior immediately.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- sme-rko-finance-front-operations-special-payments
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- dl.wel1.ru
Remediation
- Immediately remove sme-rko-finance-front-operations-special-payments from all dependencies and lock files
- Audit all systems that may have installed or required this package for signs of unauthorized binary execution or process spawning
- Review process logs and network traffic for connections to the identified C2 domains (oob-worker.cf*.workers.dev, *.dl.wel1.ru)
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm dependencies and use npm audit to identify any remaining malicious packages
- Implement package integrity verification and consider using private package registries with vetting procedures
Sources
- GitHub Advisory GHSA-28cp-6vcg-8fhv · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-operations-special-payments (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-operations-special-payments-npm-jvs5iq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malware in svelte-goal-vim
Malware was discovered in the npm package svelte-goal-vim. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in kit-hydration-vim
The npm package kit-hydration-vim contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - resolvedcritical
Malicious code in hunterone-build-probe-9210 (npm)
The npm package hunterone-build-probe-9210 contained malicious code that executed automatically via preinstall and postinstall hooks, collecting sensitive system and credential information and exfiltrating it to a third-party webhook endpoint.
npmCompromised package