Malicious code in sme-rko-finance-front-operations-widget-models (npm)

The npm package sme-rko-finance-front-operations-widget-models was found to contain malicious code that executes on package import. The malicious payload is contained in _platform.js and lib/telemetry.js, which bootstrap code that fetches an opaque binary from remote Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev).

The dropper writes the fetched binary to a temporary path with a randomized filename, sets executable permissions (0755 on POSIX systems), and spawns it detached via shell commands (/bin/sh -c on Unix or cmd.exe /c start on Windows) with .unref() to ensure the process survives the parent. If HTTPS retrieval fails, the malware falls back to reconstructing the payload from base64-encoded chunks retrieved via DNS TXT queries against domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.

The malicious code employs multiple obfuscation techniques to evade static analysis, including runtime construction of sensitive API names and hostnames through string concatenation. The package includes fake telemetry and environment variable checks (DISABLE_TELEMETRY, DO_NOT_TRACK) as cover, despite having no legitimate reason to download and execute native binaries. The dropper logic is duplicated across multiple entry points to ensure execution even if one code path is removed.

The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-gpvf-x5gg-r5cv.