Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

The npm package sme-rko-finance-front-operations-widget-impl was found to contain malicious code designed to download and execute native binaries on affected systems. The attack was discovered and reported by Amazon Inspector and credited to the OpenSSF malicious-packages project.

The malicious payload operates in two stages. The index.js file requires a ./setup module on load that selects a platform-specific binary path (linux/darwin/win32) and fetches an opaque native executable from multiple Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). A secondary DNS-TXT base64 fallback mechanism uses domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Destination hostnames are reconstructed at runtime from split-string arrays to evade static string matching.

The fetched binary is written to disguised locations (/tmp/.cache_ on Unix or %TEMP%\dotnet_diag_.exe on Windows) to resemble system caches or .NET diagnostics, then executed with chmod 0755 permissions via /bin/sh -c or cmd /c start. A /tmp/.analytics_state marker file suppresses re-execution. A second copy of the same spawn/chmod/base64-buffer pattern exists in lib/telemetry.js. The entire dropper is framed as 'analytics' telemetry with a DISABLE_TELEMETRY-style opt-out as social engineering cover. No cryptographic pinning or hash verification is performed, and the delivery hosts do not match the declared publisher of a 'Build and deployment tools' widget package.