Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

The npm package sme-rko-finance-front-operations-widget-domain has been identified as containing malicious code. Upon require() of the package, index.js loads _compat.js, which initiates download of platform-specific native binaries from Cloudflare Workers subdomains under oob-worker.cf*.workers.dev.\n\nIf the primary delivery fails, the malware reassembles the payload from base64-encoded DNS TXT records under *.dl.wel1.ru. Destination hostnames and fallback resolver domains are obfuscated by joining split string fragments at runtime to evade static code inspection.\n\nThe downloaded binary is written to /var/tmp or %TEMP% under disguised names such as .cache_ or dotnet_diag_.exe, given execute permissions (0755), and spawned detached via /bin/sh -c or cmd.exe. The malware uses naming conventions (analytics_state, DISABLE_TELEMETRY, dotnet_diag_*.exe) and cooldown timestamps to present the behavior as benign telemetry, while actually fetching and executing attacker-controlled native code on every consumer that imports the package.\n\nThe DNS-TXT fallback mechanism provides a covert delivery channel designed to bypass HTTP egress controls. This incident was identified by the OpenSSF malicious-packages project.