Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed sme-rko-finance-front-operations-tax from npm.
- Ecosystems
- Attack vectors
- Affected entities
- sme-rko-finance-front-operations-taxnpm package containing malicious code
The npm package sme-rko-finance-front-operations-tax was found to contain malicious code that executes on module import. The package's index.js loads platform.js and lib/telemetry.js, which download platform-specific binaries from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with DNS TXT-record fallback to Russian domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).\n\nThe downloaded binaries are written to temporary directories (/tmp on Unix, Windows Temp on Windows) under disguised filenames (e.g., .cache, dotnet_diag_.exe), given execute permissions (chmod 0755), and spawned as detached processes via shell commands (/bin/sh -c or cmd.exe /c start /b). The malicious code uses runtime string reassembly to obfuscate sensitive API names and hostnames, defeating static analysis.\n\nThe package's stated purpose as a finance/tax operations frontend library has no legitimate reason to fetch and execute opaque native binaries from non-publisher infrastructure. The incident was identified and credited to OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- sme-rko-finance-front-operations-tax
- Domains
- oob-worker.cf100-416.workers.dev
- cf103-070
- cf102-baf
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall sme-rko-finance-front-operations-tax from all projects and environments
- Audit any systems where this package was installed for signs of unauthorized binary execution or process spawning
- Review system logs for connections to the identified malicious domains (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru)
- Replace the package with a legitimate alternative for any required finance/tax operations frontend functionality
- Update npm dependencies and use npm audit to identify any other compromised packages
- Consider running security scans on affected systems to detect any dropped binaries or persistence mechanisms
Sources
- GitHub Advisory GHSA-p2hc-6684-r35c · GitHub Advisory Database
Cite this entry
"Malicious code in sme-rko-finance-front-operations-tax (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-sme-rko-finance-front-operations-tax-npm-1judmu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit